Chilling developments in domestic spying

The US government is obsessed about your phone calls, email, web surfing and a log of everywhere that you travel. The obsession has become so intense over the past few years, that they have had to recast the definition of data gathering. After all, warrantless wiretapping and domestic spying is illegal. And so once exposed, Uncle Sam now claims that massive public eavesdropping, archiving and data mining (including building cross-domain portfolios on every citizen) does not count as “spying” because a human analyst has not yet listened to a particular conversation. The way your government spins it, if they have not yet listened into private, domestic conversations, they can gather yottabytes of personal and businesses without any judicial oversight.

The increasing pace of Big Brother’s appetite for wads of personal data is–at the very least–alarming and more specifically, unlikely to result in anything more than a Police State. To learn about some of these events, check our recent articles on the topic of Uncle Sam’s proclivity for data gathering.

http://www.youtube.com/watch?v=r9-3K3rkPRE

Whistle blower, William Binney, explains a secret NSA program to spy on U.S. citizens without warrants

I’m Not Doing Anything Illegal. Why Should I Care?

Here at AWildDuck, we frequently discuss privacy, government snooping, and projects that incorporate or draw upon warrantless interception. In just the USA, there are dozens of projects–past and present–with a specific mandate to violate the Foreign Intelligent Surveillance Act. How can the American government get away with it? In the past decade, as leaks began to surface, they tried to redefine the meaning of domestic surveillance to exclude sweeping acts of domestic surveillance. The Bush era interpretation of USSID 18 is so farcical, that it can be debunked by an elementary school pupil. As the ruse unraveled, the wholesale gathering of data on every citizen in America was ‘legitimized’ by coupling The Patriot Act with general amnesty for past acts warrantless wiretapping. Dick Cheney invoked the specter of 911 and the urgent need to protect Americans from terrorism as justification for creating a more thorough and sweeping police mechanism than any totalitarian regime in history.

The programs go by many names, each with a potential to upend a democracy: Stellar Wind, The Patriot Act, TIA, Carnivore, Echelon, Shamrock, ThinThread, Trailblazer, Turbulence, Swift, and MINARET. Other programs thwart the use of privacy tools by businesses and citizens, such as Clipper Chip, Key Escrow and the classification of any secure web browsing as a munition that must be licensed and cannot be exported. The list goes on and on...

A myriad of dangers arise when governments ‘of-the-people and by-the-people’ engage in domestic spying, even if the motive is noble. Off the bat, I can think of four:

• Justifications are ethereal. They are based on transient goals and principles. Even if motives are common to all constituents at the time a project is rolled out, the scope of data archived or the access scenarios inevitably change as personal and administrations change.


• Complex and costly programs are self-perpetuating by nature. After all, no one wants to waste billions of taxpayer dollars. Once deployed, a massive surveillance mechanism, it is very difficult to dismantle or thwart.


• There is convincing research to suggest that domestic surveillance could aid terrorists, rather than protect civilians.


• Perhaps most chilling, is the insipid and desensitizing effect of such programs. Once it becomes acceptable for a government to spy on its citizens, it is a surprisingly small step for neighbors, co-workers and your own children to become patriotic partners in surveillance and reporting. After all, if your government has the right to preemptively look for dirt on your movement, Internet surfing, phone calls, cash transactions and sexual dalliances, then your neighbor can take refuge in the positive light of assisting law enforcement as they transmit an observation about an unusual house guest or the magazines you subscribe to.

What’s New in Domestic Spying?

This is a landmark week for anyone who values privacy and who understands that domestic spying is not a necessary tool of homeland security. This week, we are learning that US surveillance of its citizens is skyrocketing and a court case is about to either validate or slap a metaphorical wrist. Either way, each event brings us ever closer to the world depicted in Person of Interest. For now, I am citing breaking news. We’ll flush out the details soon.

• Phone location data privacy issue hits federal court Tuesday


• ACLU: Electronic surveillance by US agencies skyrocketing

Article in progress. Changes coming in the next few hours.
Figures, Photos & Links will be added. Please return soon.

Articles on Privacy & Domestic Surveillance here at AWildDuck:

• Chilling developments in domestic spying


• $1 Billion kick-starts Facial Recognition of Everyone


• Can USA Assert Jurisdiction Over Assange?


• Enhancing Privacy: Blind Signaling and Response


• Will Google “Do No Evil”?


• Big biz & Uncle Sam like Tor, sort of…


• U.S. Police Snoop Email, IMs, Phone Records


• Beijing to Impose Encryption Disclosure Rules

$1 Billion kick-starts Facial Recognition of Everyone

For access to a home or automobile, most people use a key. Access to accounts or transactions on the Internet usually requires a password. In the language of security specialists, these authentication schemes are referred to as using something that you have (a key) or something that you know (a password).

In some industries, a third method of identification is becoming more common: Using something that you are. This area of security and access is called ‘biometrics’. The word is derived from bio = body or biology and metrics = measurement.

The data center that houses computer servers for AWildDuck also houses valuable equipment and data for other organizations. When I visit to install a new router or tinker with my servers, I must first pass through a door that unlocks in the presence of my fob (a small radio-frequency ID tag on my key chain). But before I can get to the equipment cage that houses my servers, I must also identify myself by placing the palm of my hand on a scanner and speaking a code word into a microphone. I don’t know if my voice is identified as a biometric, but the use of a fob, a code word and a hand-scan demonstrates that the facility uses all three methods of identify me: Something that I have, something that I know and something that I am.

If you work with technology that is dangerous, secret, or that has investor involvement, then biometric identification or access seems reasonable. After all, something-that-you-are is harder to forge than something that you have. Because this technique is tied to part of your body, it also discourages the loaning of credentials to a spouse, friend, or blackmailer.

But up until now, biometric identification required the advance consent of the individuals identified. After all, before you can be admitted to a secure facility based on your hand print, you had to allow your hand to be scanned at some time in the past. This also suggests that you understood the legitimate goals of those needing your identification in the future.

Few Americans have been compelled to surrender their biometrics without advance consent. There are exceptions, of course. Rapists and individuals applying to live in the United States are routinely fingerprinted. Two very different demographics, and yet both are compelled to surrender a direct link to their genetic makeup. But until now, we have never seen a non-consenting and unsuspecting population subjected to wholesale cataloging of personal biometrics. Who wants all of this data? What could they do with it?

Here at AWildDuck, we have written about the dogged persistence of conservatives in the American government to seek a state of Total Information Awareness. But now, Uncle Sam is raising the stakes to a new low: The Dick Cheneys and Karl Roves aren't satisfied with compiling and mining data from that which is online, such as phone books, Facebook data, company web sites, etc. They want access to as much personal and corporate data as they can get their hands on: Bank records, credit card receipts, tax returns, library borrowing records, personal email, entire phone conversations & fax images, and the GPS history logged by your mobile phone.

Perhaps even more creepy, is the recent authorization for the use of high altitude drones for domestic law enforcement. But wait! That development pales in comparison with a minor news bulletin today. The FBI has just funded a program of facial recognition. We’re not talking about identifying a repeat bank robber, a missing felon or an unauthorized entry across our borders. We are talking about scanning and parsing the entire population into a biometric fingerprint database. The project aims to cull and track facial images – and identify each one – from every Flickr account, every ATM machine, every 7-11...in fact, every single camera everywhere.

If you have a driver’s license, a Facebook account, or if you ever appeared in a college yearbook, it’s a certainty that you will soon surrender identifiable biometrics, just like a rapist or a registered alien. By 2014, we may arrive at 1984.

The one billion dollars set aside by the FBI for the facial recognition component of Project Über Awareness belies the truly invasive scope of body-cavity probing that the Yanks want to administer. The massively funded effort includes a data archival project buried within a Utah hill that is brain-seizing in size and scope. Forget about Tera, Peta and Exabytes. Think instead of Yotta, Zeta and Haliburtabytes.

Engadget is a popular web site that reviews and discusses high tech markets, media & gadgets. Below, they discuss the facial recognition component and its privacy implications. Just as with our past articles on this topic, Engadget begins with a still image from the ABC television series Person of Interest. The show depicts the same technology and it’s all encompassing power. Whomever controls it has the power to manipulate life. But unlike Mr. Finch, a fictional champion of stalked heroines, the Big Brother version is not compelled by a concern for individual safety and security. Instead, the US government is using the specter of terrorism and public safety to bring the entire world one giant leap closer to a police state.

Do we really want our government – any government – to know every detail about our daily lives? Does the goal of securing public safety mean that we must surrender our individual freedoms and privacy completely? Are individuals who don’t care about privacy absolutely certain that they will trust their governments for all time and under all circumstances? Do they expect that the data will never be breached or used for purposes that were not originally sanctioned or intended? Is anyone that naïve?

________________________________________________________________________

FBI rolls out $1 billion public face recognition system in 2014.
Big Brother will be on to your evildoing everywhere
Reprint: Engadget.com — By Jason Hidalgo, posted Sep 9th 2012

Can USA Assert Jurisdiction Over Assange?

Most Wild Ducks are aware that WikiLeaks is a rogue distributor of classified and secret documents from anonymous news sources, news leaks and whistle blowers. At the helm is the very charming self-promoter, Julian Assange. This man attracts controversy like honey attracts flies. Dozens of governments, banks and NGOs would gladly substitute honey with “horse manure” in that simile.

In the past 2 years, WikiLeaks has threatened—and then followed through—on the release of information troves containing copious numbers of memos, orders, private communications, and tactical analyses by governments, banks, charities, NGOs, and what-have-you. To generate buzz and prevent sabotage while they vet and compile controversial disclosures, WikiLeaks occasionally pre-releases an encrypted stash of secret documents that they call an “insurance file” or, more accurately, an information bomb. Once out there, it can never be defused—The contents can be remotely detonated by anyone with an encryption key. (This can be a short phrase that is easy to remember).

During the past 2 years, WikiLeaks has been doing exactly what it has threatened (or promised, depending upon your perspective). They have disseminated enormous troves of sensitive and sometimes embarrassing documents, phone calls, faxes, emails, and other private communications without permission from those who were party to the data. Among the infringed parties (think of this as the data ‘owner’ or originator) are the US Government, Bank of America and just about anyone else that claims domain over sensitive material. WikiLeaks justifies its acts as a 21st century watchdog agency with a calling higher than any government. Their PR spin conveys an ethical rudder that pushes for transparency in all affairs. The United States points out that outted documents sometimes reveal the name of spies, and that release endangers their lives of government agents and their families. Other documents reveal the number and location of weapon systems. And still others, reveal what one country believes to be the capacity and range of another country's weapons. But that’s not all...

For WikiLeaks, it doesn’t matter that a telephone transcript reveals personal information unrelated to the government or business affairs targeted for disclosure. For example, parties arranging a phone call reveal that a premier is delayed because he is with a young mistress or a Deputy of State can’t take a call, because she is in the midst of a fierce hangover. In effect, WikiLeaks says “Hey! These are public officials supported by their subjects or constituents. Transparency is always better than secrecy, no matter what’s in the pudding. Just throw it all out there and let the chips fall as they may.”

Of course, the US Government, it’s allies, and many public and private organizations don’t see it that way! Just because a disgruntled employee or consultant has access to sensitive documents shouldn’t mean that a 3rd party organization can air on the bathroom wall. And so, Julian Assange is a wanted man.

For the past two month, Assange has been holed up at the Ecuadorian embassy in Great Britain. I mention “Great Britain” as a geographic footnote and not to imply ownership or jurisdiction. An embassy of Ecuador is sovereign Ecuadorian territory no matter whose land surrounds it. Right?

...Well, not according to the British.

Today, Ecuador’s foreign minister announced that the country is granting asylum to WikiLeaks founder Julian Assange. Of course, Assange is wanted  defying threats by the British government to storm the Ecuadorian Embassy and extradite Assange to Sweden, where he is wanted for questioning in cases of alleged rape and sexual molestation.

The US government seeks Julian Assange for trial in a US court on charges related to his role in the massive WikiLeaks disclosure of confidential documents and communications. Of course, the US considers these documents to be sensitive and they are each labeled at various levels of “Secret”. The US has laws that govern access, copying and disclosure. It’s safe to assume that the charge would be treason, conspiracy, theft, aiding the enemy, or something related to willful interference with process.

US Jurisdiction: How Can it be Asserted?

I understand all of that. But I have never seen an explanation as to how the US could assert jurisdiction or request extradition. Assange is a foreigner and his acts related to WikiLeaks took place in foreign countries. Does the US assert that anything labeled as “secret” by its military is automatically secret everywhere on Earth? That would be a tough argument, because it would require a bilateral reciprocation agreement. Assange has lived in Nairobi since 2007. Does the US protect documents and extradite individuals over everything that the Nairobi government considers to be a secret?

Of course, the United States is pursuing enablers within or serving in uniform, but Assange is not among them. His actions may have harmed US interests (this is certainly debatable)—but how can the US claim that it has domain over the legality of his acts or his capture and punishment? Having an extradition agreement doesn't mean that you can demand any individual that you seek. There has got to be a reasonable basis for the extradition. Doesn’t a bench warrant need a viable basis in law?



Swedes:
We Just Want to Try Him for Rape

The Swedes interest in Assange is ostensibly to charge him with a sex crime. That certainly sounds like a legitimate interest that is unrelated to the beef with Uncle Sam. But the Swedish government refuses to guaranty safe passage to a region that is not party to a US extradition treaty. They claim that they are bound by law to turn Assange over to the US. The solution to this quagmire is not simple, but it is achievable. Assange claims that he is willing to face that charge. Why not try him in Ecuador (or the country that becomes his safe harbor from American extradition). If he refuses, he could be tried in abstention by a Swedish court and the court sentence could be negotiated with authorities in the safe harbor country.

WikiLeaks: Is the Wholesale Release of
                   Secret Communiques Ethical?

What about the 900 pound elephant in the room? Can WikiLeaks claim that its mission is moral or ethical (carried out in the current fashion) morality of what Assange has done vis-à-vis WikiLeaks. My own readers at awildduck.com have pressed for an editorial opinion on the whole affair. Has Assange harmed US interests? Does it matter outside of the US? Did he break an “international” law? Should he be held accountable?  Should he be turned over to American authorities to stand trial?

I won’t weigh in on these issues here. The purpose of this posting is to question US jurisdiction and earnestly seek information & opinions on the basis for extradition. If you have knowledge of the law, the basis or the justification for that request, I invite your analysis and comment.

Could the Brits Really “Storm an Embassy”?

I certainly can’t imagine that the Brits would “storm the Ecuadorian embassy”. Good God, man! Regardless of treaties and acts, it is a sovereign country. In fact, I would think that the Ecuadorian could, at their discretion, grant Assange citizenship and then confer diplomatic status. This would compel a host country to guaranty safe passage to the Airport. Isn’t that the whole idea of ambassadors and the exchange of territory? Storming an embassy would place the UK in the unenviable and undistinguished company of Egypt (2011) and Iran (1979~1981). Who can forget the hostage taking? That event spawned a nightly TV show in the US and the career of Ted Koppel.

         Ellery Davies clarifies the intersection of Technology, Law and Public
         Policy. He is a contributor to Yahoo, CNet, ABC News, PCWorld and
         The Wall Street Journal. He is also Chief Editor of A Wild Duck.

Photo Mural—Sam Spratt, Gizmodo

New York & Hawaii: Frightening bedfellows lacking perspective

New York and Hawaii are bookends to 50 American states. Although separated by 8,000 km, each is rich in heritage, and with a very different political and cultural perspective. Yet, despite the distance and political differences, they are embarking on an identical and ruinous path. Bills introduced in both states suggest that legislators lack fundamental knowledge of history, democracy, economics and, especially, the nature of the Internet. More importantly, they care not a whit of personal freedoms, privacy and individual rights.

[caption id="attachment_1314" align="alignleft" width="147"] NY & HI senate: Lacking historical perspective[/caption]

I should end here with my favorite tag line, “So Sayeth Ellery”, but that would deny readers chilling facts. Facts that ought to shock the senses of every New Yorker and Hawaiian, and humiliate by association. Let’s cut to the chase: Lawmakers in the Aloha state want to criminalize anonymous internet posting while senators in the Empire State plan to create a database of every web site visited by each resident. Yes! They plan to track & archive your internet surfing history. I am not making this up!

[caption id="attachment_1262" align="alignright" width="200"] A government dB of everyone’s web surfing... Now, Isn’t that just special?![/caption]

With regrets to Dana Carvey, Isn’t that just special? After all, an individual concerned about being carded at the door is an individual with something to hide—most likely, guilty of a crime. Who else would object to registering a DNA sample before speaking on topics of the day? A law-abiding citizen doesn’t fear a government that tracks thought, medical history, private communication, bedroom fantasy, or corporate negotiation. Just what are those people afraid of?

Dear Wild Ducks: We are all those people. I am too blinded by disappointment and pity to name names or plow through the facts. (N.B. Names of the proponents are in the tags below this article). So, I offer links to well written summaries. Read along with me and weep. The US is already constructing the world’s biggest database of everything that you say, do and think. Perhaps New York and Hawaii feel left out. Or perhaps legislators in those states skipped out on high school history. More likely, they are decent individuals with good intentions, but simply poor stewards of liberty in an era of ecommerce, the Drudge Report, AWildDuck.

• New York Senate bill seeks to end anonymous internet posting
  “If the bill passes, get ready to hand over your full name and home address”


• Creepy new anti-privacy bill being considered by Hawaii legislature
  Bill would create a database detailing who visits what websites

Does anyone not find this frightening? Forget about “confidential sources”. Want to comment on a breastfeeding blog? Sure. But first, register your fingerprints with an ISP and web host! I can think of three reasons that this won’t fly. More importantly, I am concerned that our legislators don’t see this:

Reasons to avoid suppressing a privacy technology

• If a government bans free expression, the business of internet hosting & access simply migrates to jurisdictions that understand democracy. It’s the nature of any fungible medium.


• Political restrictions on existing technologies or platforms create incentives for the rapid deployment of methods that circumvent or thwart the restrictions. This has the unintended effect of causing even more interference with legitimate investigations and forensic tools.


• History demonstrates the dangers of surrendering free, anonymous speech to a government, no matter how ethical the current leaders. Governments are transient, though they try hard to be self-preserving. They do their best work when prodded by free and democratic constituents.

So sayeth Ellery.

Ellery Davies is not generally known as a liberal commentator.
But he is a political wonk, privacy advocate and editor of AWildDuck.

Enhancing Privacy: Blind Signaling and Response

Welcome Engadget & TechCrunch Readers

This primer describes a privacy enhancement that is transparent to users, yet allows Google and other online services to provably shield personal data from prying eyes—even from themselves. The data is meaningful for only a clearly defined purpose and without trackback or correlation to individual users.

It is not yet built into major online services. But as it crosses development and test milestones, it is attracting attention and community scrutiny.

Takeaway #1: Blind Signaling and Response encrypts and anonymizes personal data while supporting a marketing backchannel (what Google marketing partners pay for).

Takeaway #2: I am an inventor. I seek to build a career in Privacy technology centered around the development and roll out of Blind Signaling and Response. If you influence companies that gather personal user data, contact me today. Your organization, its clients, and your users will benefit. Your advertising revenue model will be preserved.

In the article directly beneath this one, I claimed that Google can protect individual user data and privacy without detriment to their revenue model. In fact, it would be a great stride in the user perception of trust and a commitment to privacy. I also claimed that Google could modify their services in such a way that would prevent any leak of personal information, even if compelled to turn over data by totalitarian governments around the world.

That posting has become popular. Readers have asked me to peel back the cover and I have even been approached by Google. (Perhaps it will lead to an affiliation. I admire Google, and would love to work with the company).

The magic behind my claims is a method of collecting and storing data that prevents anyone but the intended party from making sense of what is stored. It’s not based on just data encryption, but rather a clever outgrowth of encryption technology that I call blind signaling and response.

Before we can understand Blind Signaling and Response, it helps to understand classic signaling.

When someone has a need, he can search for a solution. When an individual is aware of their needs and problems, that’s typically the first step in marrying a problem to a solution. But in a marketing model, a solution (sometimes, one that a user might not even realize he would desire) reaches out to individuals.

Of course the problem with unsolicited marketing is that the solution being hawked may be directed at recipients who have no matching needs. Good marketing is a result of careful targeting. The message is sent or advertised only to a perfect audience, filled with Individuals who are glad that the marketer found them. Poor marketing blasts messages at inappropriate lists or posts advertisements in the wrong venue. For the marketer (or Spam email sender), it is a waste of resources and sometimes a crime. For the recipient of untargeted ads and emails, it is a source of irritation and an involuntary waste of resources, especially of the recipient’s attention.

Consider a hypothetical example of a signal and its response:

Pixar animators consume enormous computing resources creating each minute of animation. Pixar founder, John Lasseter, has many CGI tools at his disposal, most of them designed at Pixar. As John plans a budget for Pixar’s next big film, suppose that he learns of a radical new animation theory called Liquid Flow-Motion. It streamlines the most complex and costly processes. His team has yet to build or find a practical application that benefits animators, but John is determined to search everywhere.

Method #1: A consumer in need searches & signals

Despite a lack of public news on the nascent technique, John is convinced that there must be some workable code in a private lab, a university, or even at a competitor. And so, he creates a web page and uses SEO techniques to attract attention.

The web page is a signal. It broadcasts to the world (and hopefully to relevant parties) that Pixar is receptive to contact from anyone engaged in Liquid Flow-Motion research. With Google’s phenomenal search engine and the internet’s reach, this method of signaling may work, but a successful match involves a bit of luck. Individuals engaged in the new art may not be searching for outsiders. In fact, they may not be aware that their early stage of development would be useful to anyone.

Method #2: Google helps marketers target relevant consumers

Let’s discuss how Google facilitates market-driven signaling and a relevant marketing response today and let us also determine the best avenue for improvement...

At various times in the past few weeks, John had Googled the phrase “Liquid Flow-Motion” and some of the antecedents that the technology builds upon. John also signed up for a conference in which there was a lecture unit on the topic (the lecture was not too useful. It was given by his own employee and covered familiar ground). He also mentioned the technology in a few emails.

Google’s profile for John made connections between his browser, his email and his searches. It may even have factored in location data from John’s Android phone. In Czechoslovakia, a grad student studying Flow-Motion has created the first useful tool. Although he doesn’t know anything about Google Ad Words, the university owns 75% of the rights to his research. They incorporate key words from research projects and buy up the Google Ad Words “Liquid Flow-Motion”.

Almost immediately, John Lasseter notices very relevant advertising on the web pages that he visits. During his next visit to eBay, he notices a home page photo of a product that embodies the technique. The product was created in Israel for a very different application. Yet it is very relevant to Pixar’s next film. John reaches out to both companies–or more precisely, they reached out in response to his signal, without even knowing to whom they were replying.

Neat, eh? What is wrong with this model?

For many users, the gradual revelation that an abundance of very personal or sensitive data is being amassed by Google and the fact that it is being marketed to unknown parties is troubling. Part of the problem is perception. In the case described above and most other cases in which the Google is arbiter, the result is almost always to the user’s advantage. But this fact, alone, doesn’t change the perception.

But consider Google’s process from input to output: the collection of user data from a vast array of free user services and the resulting routing of ads from marketing partners. What if data collection, storage and manipulation could be tweaked so that all personal data–including the participation of any user–were completely anonymized? Sounds crazy, right? If the data is anonymized, it’s not useful.

Wrong.

Method #3: Incorporate blind signaling & response into AdWords
— and across the board

A signaling and response system can be constructed on blind credentials. The science is an offshoot of public key cryptography and is the basis of digital cash (at least, the anonymous form). It enables a buyer to satisfy a standard of evidence (the value of their digital cash) and also demonstrate that a fee has been paid, all without identifying the buyer or even the bank that guarantees cash value. The science of blind credentials is the brainchild of David Chaum, cryptographer and founder of DigiCash, a Dutch venture that made it possible to guaranty financial transactions without any party (including the bank) knowing any of the other parties.

The takeaway from DigiCash and the pioneering work of David Chaum is that information can be precisely targeted–even with a back channel–without storing or transmitting any data that aids in identifying the source or target. (Disclosure: I designed the back channel mechanism, which is not a design requirement of Chaum’s DigiCash implementation. As of June 2012, I am working toward a patent). Even more interesting is that the information that facilitates replying to a signal can be structured in a way that is useless to both outsiders and even to the database owner (in this case, Google).

The benefits aren’t restricted to Internet search providers. Choose the boogeyman: The government, your employer, someone taking a survey, your grandmother. In each case, the interloper can (if they wish) provably demonstrate to that meaningful use of private data is restricted-by-design to a stated purpose.

It’s reasonable to assume that privacy doesn’t exist in the Internet age. After all, unlike a meeting at your dining table, the path from whisper to ear passes through a public network. Although encryption and IP re-routing ensure privacy for P2P conversations, it seems implausible to maintain privacy in everyday searches, navigation, and online email services, especially when services are provided at no cost to the user. Individuals voluntarily disgorge personal information in exchange for services, especially, if the goal is to keep the service provider incented to offer the service. For this reason, winning converts to Blind Signaling and Response requires a thoughtful presentation.

Suppose that you travel to another country and walk into a bar. You are not a criminal, nor a particularly famous or newsworthy person. You ask another patron if he knows where to find a good Cuban cigar. When you return to your country, your interest in cigars will probably remain private and so will the fact that you met with this particular individual or even walked into that bar.

Gradually, the internet is facilitating at a distance the privileges and empowerment that we take for granted in a personal meeting. With end-to-end encryption, it has already become possible to conduct a private conversation at a distance. With a TOR proxy and swarm routing, it is also possible to keep the identities of the parties private. But today, Google holds an incredible corpus of data that reveals much of what you buy, think, and fantasize about. To many, it seems that this is part of the Faustian bargain:

• If you want the benefits of Google services, you must surrender personal data


• Even if you don’t want to be the target of marketing,* it’s the price that you pay for using the Google service (Search, Gmail, Drive, Navigate, Translate, Picasa, etc).

Of course, Google stores and act on the data that it gathers from your web habits. But both statements above are false!

a)  If Google incorporates Blind signaling technology into its services, you will get all the benefits of each Google service without anyone discovering a useful piece of personal data. Moreover, Google will still benefit your use of their services just as they do now.

b)  Surrendering personal data in a way that does not anonymize particulates it is not “the price that you pay for Google services”. First, Google is paid by the marketer and not individual end users. But more importantly, the marketers can still get the full advantage of sending you relevant, targeted messages while Google protects your privacy en toto! They can take steps to make the data useless to any other party and for any other purpose. Google and their marketing partners will continue to benefit exactly as they do now.

Article in process...

* This is also a matter of perception. You really do want targeted messaging. Even if you hate spam and, like me, prefer to search for a solution instead of have marketers push a solution to you. In a future article, I will demonstrate that every individual is pleased by relevant messaging, even if it is unsolicited, commercial or sent in bulk.

Will Google “Do No Evil”?

Google captures and keeps a vast amount of personal information about its users. What do they do with all that data? Despite some very persistent misconceptions, the answer is “Nothing bad”. But they could do a much better job ensuring that no one can ever do anything bad with that data—ever. Here is a rather simple but accurate description of what they do with what is gleaned from searches, email, browsing, documents, travel, photos, and more than 3 dozen other ways that they learn about you:

• Increase the personal relevance of advertising as you surf the web


• Earn advertising dollars–not because they sell information about you–but
  because they use that data to match and direct relevant traffic toward you

These aren’t bad things, even to a privacy zealot. With or without Google, we all see advertising wherever we surf. Google is the reason that so many of the ads appeal to our individual interests.

But what about all that personal data? Is it safe on Google’s servers? Can they be trusted? More importantly, can it someday be misused in ways that even Google had not intended?

I value privacy above everything else. And I have always detested marketing, especially the unsolicited variety. I don’t need unsolicited ‘solutions’ knocking on my door or popping up in web surfing. When I have needs, I will research my own solutions—thank you very much.

It took me years to come to terms with this apparent oxymoron, but the personalization brought about by information exchange bargains are actually a very good bargain for all parties concerned, and if handled properly, it needn’t risk privacy at all! In fact, the things that Google does with our personal history and predilections really benefits us, but...

This is a pro-Google posting. Well, it’s ‘pro-Google’ if they “do no evil” (Yes—it’s the Google mantra!). First the good news: Google can thwart evil by adding a fortress of privacy around the vast corpus of personal data that they collect and process without weakening user services or the value exchange with their marketing partners. The not-so-good news is that I have urged Google to do this for over two years and so far, they have failed to act. What they need is a little urging from users and marketing partners. Doing no evil benefits everyone and sets an industry precedent that will permeate online businesses everywhere.

The CBS prime time television series, Person of Interest, pairs a freelance ‘James Bond’ with a computer geek. The geek, Mr. Finch, is the ultimate privacy hack. He correlates all manner of disparate data in seconds, including parking lot cameras, government records, high school yearbook photos and even the Facebook pages of third parties.

[caption id="" align="alignleft" width="300"] Mr. Finch & Eric Schmidt: Separated at birth?[/caption]

It’s an eerie coincidence that Google Chairman, Eric Schmidt, looks like Mr. Finch. After all, they both have the same job! They find a gold mine of actionable data in the personal dealings of everyone.

Viewers accept the TV character. After all, Finch is fictional, he is one of the good guys, and his snooping ability (especially the piecing together of far-flung data) is probably an exaggeration of reality. Right?!

Of course, Eric Schmidt & Google CEO Larry Page are not fictional. They run the largest data gathering engine on earth. I may be in the minority. I believe that Google is “one of the good guys”. But let’s first explore the last assumption about Mr. Finch: Can any organization correlate and “mine” meaningful data from a wholesale sweep of a massive eavesdropping machine and somehow piece together a reasonable profile of your interests, behavior, purchasing history and proclivities? Not only are there organizations that do this today, but many of them act with our explicit consent and with a disclosed value exchange for all that personal data.

Data gathering organizations fall into three categories, which I classify based on the exchange of value with web surfers and, more importantly, whether the user is even aware of their role in collecting data. In this classification, Google has moved from the 2nd category to the first, and this is a good thing:

1. Organizations that you are aware of–at least peripherally–and for which there is a value exchange (preferably, one that is disclosed). Google comes to mind, of course. Another organization with informed access to your online behavior is your internet service provider. If they wanted to compile a dossier of your interests, market your web surfing history to others, or comply with 3rd party demands to review your activities, it would be trivial to do so.


2. Organizations with massive access to personal and individualized data, but manage to “fly beneath the Radar”. Example: Akamai Technologies operates a global network of servers that accelerate the web by caching pages close to users and optimizing the route of page requests. They are contracted by almost any company with a significant online presence. It’s safe to say that their servers and routers are inserted into almost every click of your keyboard and massively distributed throughout the world. Although Akamai’s customer relationship is not with end users, they provide an indirect service by speeding up the web experience. But because Internet users are not actively engaged with them (and are typically unaware of their role in caching data across the Internet), there are few checks and on what they do with the click history of users, with whom they share data, and if–or how–individualized is data is retained, anonymized or marketed.


3. National governments. There is almost never disclosure or a personal value exchange. Most often, the activity involves compulsory assistance from organizations that are forbidden from disclosing the privacy breach or their own role in acts of domestic spying.

[caption id="attachment_1193" align="alignright" width="200"] The US is preparing to spy on everyone, everywhere, at all times. The massive & intrusive project stuns scientists involved.[/caption]

I have written about domestic spying before. In the US, It has become alarmingly broad, arbitrary and covert. The über secretive NSA is now building the world’s biggest data gathering site. It will gulp down everything about everyone. The misguided justification of their minions is alternatively “anti-terrorism” or an even more evasive “911”.

Regarding, category #2, I have never had reason to suspect Akamai or Verizon of unfair or unscrupulous data mining. (As with Google, these companies could gain a serious ethical and market advantage by taking heed of today’s column.) But today, we focus on data gathering organizations in category #1—the ones with which we have a relationship and with whom we voluntarily share personal data.

Google is at the heart of most internet searches and they are partnered with practically every major organization on earth. Forty eight free services contain code that many malware labs consider to be a stealth payload. These doohickeys give Google access to a mountain of data regarding clicks, searches, visitors, purchases, and just about anything else that makes a user tick.

It’s not just searching the web that phones home. Think of Google's 48 services as a marketer’s bonanza. Browser plug-ins phone home with every click and build a profile of user behavior, location and idiosyncrasies. Google Analytics, a web traffic reporting tool used by a great many web sites, reveals a mountain of data about both the web site and every single visitor. (Analytics is market-speak for assigning identity or demographics to web visits). Don’t forget Gmail, Navigate, Picassa, Drive, Google Docs, Google+, Translate, and 3 dozen other projects that collect, compare and analyze user data. And what about Google’s project to scan everything that has ever been written? Do you suppose that Google knows who views these documents, and can correlate it with an astounding number of additional facts? You can bet Grandma Estelle’s cherry pie that they do!

How many of us ever wonder why all of these services are free to internet users everywhere? That’s an awful lot of free service! One might think that the company is very generous, very foolish, or very unprofitable. One would be wrong on all counts!

Google has mastered the art of marketing your interests, income stats, lifestyle, habits, and even your idiosyncrasies. Hell, they wrote the book on it!

But with great access to personal intelligence comes great responsibility. Does Google go the extra mile to protect user data from off-label use? Do they really care? Is it even reasonable to expect privacy when the bargain calls for data sharing with market interests?

At the end of 2009, Google Chairman, Eric Schmidt made a major gaffe in a televised interview on CNBC. In fact, I was so convinced that his statement was toxic, that I predicted a grave and swift consumer backlash. Referring to the Billions of individuals using Google search engine, investigative anchor, Maria Bartiromo, asked Schmidt why it is that users enter their most private thoughts and fantasies. She wondered if they are aware of Google’s role in correlating, storing & sharing data—and in the implicit role of identifying users and correlating their identities with their interests.

Schmidt seemed to share Bartiromo’s surprise. He suggested that internet users were naive to trust Google, because their business model is not driven by privacy and because they are subject to oversight by the Patriot Act. He said:

If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place. If you really need that kind of privacy, the reality is that search engines -- including Google -- do retain this information for some time and it's important, for example, that we are all subject in the United States to the Patriot Act and it is possible that all that information could be made available to the authorities.

At the time, I criticized the statements as naive, but I have since become more sanguine. Mr. Schmidt is smarter than me. I recognize that he was caught off guard. But clearly, his response had the potential to damage Google’s reputation. Several Google partners jumped ship and realigned with Bing, Microsoft’s newer search engine. Schmidt’s response became a lightning rod–albeit brief–for both the EFF (Electronic Freedom Foundation) and the CDT (Center for Democracy & Technology). The CDT announced a front-page campaign, Take Back Your Privacy.

But wait...It needn’t be a train wreck! Properly designed, Google can ensure individual privacy, while still meeting the needs of their marketing partners - and having nothing of interest for government snoops, even with a proper subpoena.

I agree with the EFF that they undermine Google’s mission. Despite his high position, Schmidt may not fully recognize to that Google's marketing objectives can coexist with an ironclad guarantee of personal privacy – even in the face of the Patriot Act.

Schmidt could have had salvaged the gaffe quickly. I urged him to quickly demonstrate that he understands and defends user privacy. But I overestimated consumer awareness and expectations for reasonable privacy. Moreover, consumers may feel that the benefits of Google’s various services inherently trade privacy for productivity (email, taste in restaurants, individualized marketing, etc).

Regarding a damning consumer backlash for whitewashing personal privacy with their public, I was off by a few years, but in the end, my warnings will be vindicated. Public awareness of privacy and especially of internet data sharing and data mining has increased. Some are wondering if the bargain is worthwhile, while others are learning that data can be anonymized and used in ways that still facilitate user benefits and even the vendor’s marketing needs.

With massive access to public data and the mechanisms to gather it (often without the knowledge and consent of users), comes massive responsibility. (His interview contradicts that message). Google must rapidly demonstrate a policy of “default protection and a very high bar for sharing data. In fact, Google can achieve all its goals while fully protecting individual privacy.

Google’s data gathering and archiving mechanism needs a redesign (it’s not so big a task as it seems): Sharing data and cross-pollination should be virtually impossible – beyond a specified exchange between users and intended marketers. Even this exchange must be internally anonymous, useful only in aggregate, and self expiring – without recourse for revival. Most importantly, it must be impossible for anyone – even a Google staffer – to make a personal connection between individual identities and search terms, Gmail users, ad clickers, voice searchers or navigating drivers!

I modestly suggest that Google create a board position, and give it authority with a visible and high-profile individual. (Disclosure, I have made a “ballsy” bid to fill such a position. There are plenty of higher profile individuals that I could recommend).

Schmidt’s statements have echoed for more than 2 years now. Have they faded at all? If so, it is because Google’s services are certainly useful and because the public has become somewhat inured to the creeping loss of privacy. But wouldn’t it be marvelous if Google seized the moment and reversed that trend. Wouldn’t it be awesome if someone at Google discovered that protecting privacy needn’t cripple the value of information that they gather. Google’s market activity is not at odds with protecting their user’s personal data from abuse. What’s more, the solution does not involve legislation or even public trust. There is a better model!

They are difficult to contain or spin. As Asa Dotzler at FireFox wrote in his blog, the Google CEO simply doesn’t understand privacy. Here in USA, Schmidt’s statements have become a lightning rod for both the EFF and CDT (Center for Democracy & Technology). The CDT has even launched a front page campaign to “Take Back Your Privacy”.

Google’s not the only one situated at a data Nexus. Other organizations fly below the radar, either because few understand their tools or because of Government involvement. For example, Akamai probably has more access to web traffic data than Google. The US government has even more access because of an intricate web of programs that often force communications companies to plant data sniffing tools at the junction points of massive international data conduits. We’ve discussed this in other articles, and I certainly don’t advocate that Wild Ducks be privacy zealots and conspiracy alarmists. But the truth is, the zealots have a leg to stand on and the alarmists are very sane.

Big biz & Uncle Sam like Tor, sort of...

Oceans of Data
Try to visualize all the data about you that is recorded, stored or transmitted each day in one form or another. Consider every possible source, both public and private. What if it could all be put together, correlated with data about every other person on earth and sifted by detectives whose only task is to look for subtle patterns of behavior?

Let’s start with phone calls: In addition to the number dialed, the phone company knows your location, the caller of ID of incoming calls, and even has access to the actual conversation. (Believe it or not, your government is listening). Check the phone bill of both parties and we can figure out how often you call each other. If we then learn everything we can about the people that you talk to, we can probably learn a thing or two about you. And speaking about location, did you know that both iPhones and Android phones log your precise location every few seconds and then transmit your location history to Apple or Google several times each hour? An even more ominous program discovered this week is embedded in Android phones. It sends every keystroke to your carrier even if you opt out.

What about your health records, magazine subscriptions, tax filings, legal disputes, mortgage records, banking transactions including charge card purchases? Now add your internet use – not just the sites at which you are registered, but every site you have ever visited. Suppose we add videos from convenience stores, traffic enforcement cameras and every ATM that you pass. Don't forget the snapshot at the toll booth. They have one camera pointed at your face and another at the license plate. Of course, there is also a log entry from the toll payment device on your windshield and the key chain FOB that you use when you buy gas.

What about the relationships that are revealed by your old high school yearbook, old newspaper articles or that 4th grade poetry contest your daughter was in. There was a handout that night and so it counts as information related to you. How about that camera in the elevator at work? Suppose that it could recognize your face immediately and match it up with your fingerprints from your last international flight and your phone calls, web visits, hotel reservations and TV viewing habits.

Whew! That's a lot of information to recognize or sift through in any meaningful way. But for a moment, ask yourself “What If”... What if all that data from every transaction record, GPS device, tax return and historical log could all be accurately attributed, correlated, matched and analyzed. What could be accomplished with all of this? Who wants it and for what purpose? Would their goals align with yours?

Person of Interest
In the CBS Television series, Person of Interest, a government computer looks for clues to the next terrorist event by monitoring virtually everyone and everything. The project doesn’t require its creators to build a new surveillance network. Massive amounts of data are already floating around us every day.

Of course, the data is fragmented. It was gathered for different reasons – mostly for private commerce (banking, medicine, safety). Few people consider it to impact privacy or personal freedoms, because we assume that It is too disparate and unwieldy for analysis by any single entity. Yet, in Person of Interest, the computer taps into all of these sources and mines the data for suspicious patterns.

As patterns emerge from all of this data, the computer finds converging threads based on individual behavior. Taken alone, the data points are meaningless — someone in Oregon signs for a package; someone using a different name in Rhode Island makes a plane reservation; someone in Pakistan fitting both descriptions checks into a motel and visits a convicted arms smuggler. The mobile phone carried by the last person accepts a phone call at a number previously used by one of the other individuals. Normally, no one could have ever fit these pieces together.

Eventually, the computer begins to identify suspicious activity. Depending on the programming and based on past findings, it even predicts events. But wait! Many of the patterns it finds are unrelated to terrorism. It finds clues to likely mob hits, crimes of passion, kidnapping, guns at school, and regional crime. The results are irrelevant to the machine's purpose and in this fictional drama, the government decide that analysis would constitute illegal domestic spying. So they order the programmer to purge "irrelevant data" by adding a software routine to periodically delete extraneous results.

Of course, if the "personal" results were deleted, we wouldn't have a new and exciting television series (my personal favorite). So, the middle-age geek who gave life to the analytics, recasts himself as a vigilante. He teams up with a former special ops agent (in the mold of Harrison Ford) and together, they follow data-mined leads in hope of saving innocent individuals.

In the US, our government has such a program. In fact, there are many Total Information Awareness projects. Unlike the Hollywood version, there was never any intent to purge personal information. In fact, it's collection and analysis is the whole point. Another difference with the television series is that our government is not satisfied to mine public data or even legally obtained data. Instead, The federal government adds new primary data mechanisms every month and builds enormous enterprises to spy on individuals. This results in voluminous information daily, all of it available for future data mining without anyone's knowledge or consent.

Of course, information and videos of individuals are routinely recorded wherever we go. But typically, we assume that this information is not centrally gathered, compared or analyzed. Most people assume that they are "off the radar" if they are not being actively tracked as part of an investigation. But with data mining techniques, no one is really off the radar. Machines make decisions about patterns that should be flagged and escalated for additional scrutiny.

Mixmaster: An Innocent Tool or Antiforensics?
In the 1990's, despite a background in cryptography and computer science, I wasn't aware of these programs. In the fields of political science and sociology, I was a ninnyhammer. It is either coincidence or perhaps prescience that I proposed and then participated in a project called a Mixmaster more than a decade ago...

The idea was simple: As you surf the web or send mail, your digital footprints are randomized so that an interloper or investigator could not piece together the participants in an internet exchange, nor determine the habits of an individual user. Well, they're not really random, but the IP address reported to the email service or web page you visit is substituted by one associated with another participant in the project. That's because each data leaving your PC is relayed through internet services associated with the others. We added a few simple facets to further obscure tracks:

• 
  
  Recognizing that a rogue participant might keep a log on the individuals who hand off data through his own relay (or may be compelled to do so in the future), our code automatically increased the number of 'hops' in relationship to the number of available peers. Anonymity was enhanced, because an unfriendly investigator attempting to trace the source of a web visit or email would need cooperation from a larger pool of participants.


• 
  
  Data between participants ware encrypted and randomized in length and even timing, to thwart possible forensic analysis.


• 
  
  A backward channel was added, but with very tight rules on expiration and purging. This allowed packet acknowledgement, web site navigation, and even two-way dialogue while still preserving anonymity.

Privacy & Politics
For most of us involved in the project, we had no endgame or political agenda. We simply recognized that it is occasionally comforting to send email, browse the web or post to a public forum without leaving a traceable return address. To those who claimed that our work might aid money launderers, terrorists or child molesters, we explained that identification and authentication should be under control of parties involved in a conversation. The internet is a new communications medium. But it was not designed to undermine the privacy of every conversation for the purpose of facilitating future forensic investigation. Investigators – if their purpose is supported by judicial oversight –have many old school methods and tools to aid their detective work. The growth of a new communication medium must not become a key to suppression or compromised privacy.

[caption id="attachment_702" align="alignright" width="254"] Vacuum-cleaner surveillance[/caption]

Anonymous, but authenticated
There is a big difference, between identification and authentication. In a democracy, citizens are authenticated at the polls. But they enter a private booth to cast their vote and they turn in a ballot without a signature. They are identified (or even better, authenticated without identification) for the purpose of verifying eligibility. But their identity is not carried over to their voting decision. The real business is effectively anonymous.

This isn't to say that all authorized entry systems should allow anonymous access. Of course not! Access entry systems typically might asks "Who are you?" (your User ID) and then ask for proof (typically a password). Your identity is not always required, but proof of authorized access can come in 3 forms. Very secure systems (such as banks) require at least 2 of these before allowing access:

• something you know: A password or challenge


• something you have: Evidence that you have a token or card


• something you are:    A fingerprint, recognizable face, or voice match

In each case, it is the person behind the door that needs your identity or authorization and not your government.

Anonymity and encryption go hand in hand. Both technologies are used to ensure that internet communication is private and does not become the affair of your friends, employer, former spouse, or government overseers. So where, exactly, does your government stand on the use of internet encryption or anonymity? In most of the world, the answer is clear. Governments stand for propaganda and crowd control. They are against any technology that enhances privacy. But this is not a universal axiom: In Germany, they stand on the side of citizens. Your data and your identity belong to you. Very little of your affairs are open to the government. But in the United States, the answer is very murky...

[caption id="attachment_707" align="alignleft" width="250"] The NSA conducts vacuum-cleaner surveillance of all data crossing the Internet--email, web surfing… everything!  --Mark Klein[/caption]

Under George W. Bush, every bit of information was Uncle Sam's business. With oversight by Dick Cheney (and hidden from legislative or judicial oversights), the executive branch concocted mechanisms of blatant domestic spying. Of course, the ringleaders realized that each mechanism violated the US constitution protection from unreasonable search, and so it was ordered and implemented covertly until a technician working for AT&T blew the whistle. Suddenly stories were surfacing that Uncle Sam was implementing a Reagan era project that had been shelved during the Clinton era. This launched a scramble to win public support for The Patriot Act, an absurd euphemism which attempts to whitewash illegal snooping as the patriotic duty of each citizen (talk about ‘deceptive’! Our leaders must think that we are sheep. Not just your garden variety grass-eating sheep, but really, really dumb sheep that feed on bull chips!).

       -=-=-=-=-=-=-=-   (writing in progress)

... until  and  (including preemptive data mining with programs like Dick Cheney's "total information awareness"), back doors built into encryption chips, "deep packet" data sniffing installed at  major switching center, satellite interception of phone calls, and national security letters (a euphemism for warrantless snooping).

Before the Obama administration, the answer was clear. These technologies are barely tolerated for banking, medicine and commerce. But they are to be weakened, subterfuged or thwarted when used by private citizens. In each case, the government sought to block the technology or insert a back door into the programming code (and into actual data centers) for use during any future investigation. Of course, in a bold era of predictive behavior modeling, authorized investigations often gives way to fishing expeditions for the sole purpose of information gathering.

But something has changed in the past 2 years. As news spread about Internet censorship in China, the Arab spring, and covert schools for girls in Taliban controlled regions of Afghanistan, the US government began to recognize that uncensored and even untraceable Internet use sometimes coincided with foreign policy objectives. Imagine the conundrum this revelation must have generated within the state department! On the one hand, the Patriot Act sanctions blatant acts of domestic spying (including preemptive data mining with programs like Dick Cheney's "total information awareness"), back doors built into encryption chips, "deep packet" data sniffing installed at  major switching center, satellite interception of phone calls, and national security letters (a euphemism for warrantless snooping). Yet, they also support freedom of speech and privacy for anything that supports US policy amongst our friends.

-=-=-=-=-=-=-

Today, this model has been widely adopted and greatly enhanced by an open source project called Tor. In this blog, I won't try to justify the need for robust anonymous relays. Better writers and social philosophers than me have explained why free and anonymous communications channels are central to a free and democratic society. Better writers than me have chronicled the abuse of the Patriot Act, Echelon, TIA and numerous other abuses of government forms of overreach. Better writers than me have explained how open and free communication leads to increased safety even if it sometimes facilitates communications among terrorists, digital pirates or pornographers.

-=-=-=-=-=-=-

Turn of Events: Government as Advocate

• Obama lends support to Tor


• Tor to users: Use Amazon Cloud as bridge to anonymity  (this section under development)

Additional Reading

• Carrier IQ (CIQ): A secret routine is embedded in Android phones sends every user keystroke to the network carrier, even when you opt out of every single connectivity feature. It cannot be uninstalled and cannot be uninstalled nor even shut down!


• Surrounded by Surveillance: Is Everything Spying On You?
  
  [caption id="attachment_784" align="alignright" width="256"] Pigeons aren't the only ones listening. The light pole itself broadcasts conversations.[/caption]
  
  Even municipal light posts send conversations to government agencies, supposedly to aid first responders in an emergency. But wait! The manufacturer “proudly contacted DARPA” to suggest a more sinister use for the data collected from hidden microphones?


• Wikipedia entry: Information Awareness Office (introduction & overview)


• Official DARPA site: Information Awareness Office


• The Smoking Gun: Discovery of Massive "Vacuum Sweep" Domestic Spying
  Leads to Patriot Act (euphemism for act of Profound Anti-Americanism)

Beijing to Impose Encryption Disclosure Rules

I originally wrote this piece in April 2010 as feedback to this article in The Wall Street Journal.
__________________________________________________________

Another reader, Felix Wyss, correctly points out that this WSJ article is unclear on the information demanded by Chinese authorities. Every open or public key encryption standard is based on a disclosed algorithm. That's the whole point. It is the complexity of reversing that algorithm that makes the encryption secure...

If the Chinese government wants more information about the algorithm used to encode data for transmission or archival – For example, to ensure that it is secure – then I say, "Absolutely! Get all the information you like". But if they want a key escrow or back door, they are barking up a dead tree stump. Been there. Done that. Our own government tried this. In the words of Dana Carvy: "Not Gonna Happen".

Even under communist rule, that wouldn't be encryption at all. And with the growing clout of economic success, Chinese companies won't stand for it. The Party would do better by demanding that routers or firewalls force users to create two keys: One for the end user and one for the network admin. That would promote good business practice. Of course, turning over the 2nd key to anyone outside of the immediate work group  or family would require active user consent and compliance.

Hey China! Let's face it: The days of suppressing free speech or forcing products to snitch on their users is coming to an ignoble end. The secret police of Romania, East Germany, the Soviet Union and Iraq have all disbanded - or at least redirected to classic gum shoe detective work and intelligence gathering. Terrorism is the new enemy and not the private business and political activities of your own citizens. You have shown a remarkable ability to emerge as an economic superpower, making things that people like, exporting quality products, all while raising the standard of living for your population. Ultimately, this helps all countries. But now you have some very ugly skeletons to sweep out of your closet. Modern 1st world countries cannot forever suppress political and religious freedom.

Grow up. We really do want you to enter the community of nations some day.

- Ellery Davies
Ellery Davies clarifies law and public policy. Feedback is always welcome.