Only Congress can defend our right to private conversation

By Bob Goodlatte
Real Clear Wire

Imagine you’re walking through a quiet park with your best friend. You lower your voices and speak privately about something very personal and sensitive. You need no government permission to have this conversation. You do not expect an intelligence agency to listen in and decide whether your conversation sounds suspicious.

You’re just two friends, talking. Why shouldn’t we expect the same freedom to speak freely and privately when we communicate online?

Wednesday, Oct. 21, is Global Encryption Day, an occasion to defend the technology that makes digital conversations as private as those you have with your friends and family. But encryption is in danger of being broken by demands from governments at home and abroad.

Encryption protects our banking transactions, medical privacy, business secrets, and personal communications. End-to-end encryption on services such as Signal goes further: Properly implemented, it allows only the communicating parties to read their messages, keeping even the service provider from opening them.

For many people, that protection can be a lifeline.

A woman fleeing a violent stalker needs to communicate with her children and her shelter without exposing their plans. A journalist needs to speak with a whistleblower without delivering that source to the people whose misconduct is being exposed. Dissidents, religious minorities, and political opponents living under authoritarian governments need room to organize, worship, and dissent without inviting arrest.

Privacy makes these freedoms possible. People cannot speak freely when every conversation can be construed as evidence against them.

Yet governments keep demanding a special key into encrypted communications. They call it “lawful access,” suggesting that officials can obtain that key without compromising everyone else’s security.

Imagine if the government required every locksmith to furnish government officials with duplicate keys to every residence. Now imagine that those keys could be copied instantly, stolen remotely, and distributed worldwide. That is the danger of an encryption backdoor. Once created, an access mechanism becomes a target for criminal hackers, hostile intelligence services, and abusive officials.

And if encryption is broken anywhere, it will eventually be broken everywhere.

Consider the confrontation between the British government and Apple. After initially demanding access to Apple’s encrypted cloud backups worldwide, the British government reportedly replaced that demand with a narrower order covering UK customers. Apple reportedly filed a legal challenge to the narrower demand with Britain’s Investigatory Powers Tribunal. The government’s insistence on secrecy for itself and open access to everyone else characterizes the surveillance mentality. Narrowing London’s order does not eliminate the worldwide security risks of the capability it demands.

Canada’s proposed Lawful Access Act is raising alarms as well. House Judiciary Chairman Jim Jordan and House Foreign Affairs Chairman Brian Mast warn that Bill C-22 could compel American companies to build access mechanisms into encrypted systems, creating vulnerabilities that threaten Americans’ communications across the border.

The European Commission is also pursuing a technology roadmap for law enforcement access to encrypted data, while pledging to preserve cybersecurity and fundamental rights. Those nicely balanced promises do not resolve the technical risks. Calling access lawful does not make the underlying technology safe.

The problem with each of these approaches is that a vulnerability created for one country cannot be trusted to stay within its borders. American users depend on the same companies, services, and security systems. Access capabilities can be stolen, replicated, or shared among governments. Our own agencies could exploit openings created abroad to expand warrantless access to Americans’ communications. Congress must prevent foreign mandates from eliminating Americans’ last redoubt for protected communications.

When Congress returns after the election, it should prohibit government agencies from compelling companies to weaken encryption or build surveillance access into secure products. It should give American diplomats clear authority and concrete tools to resist foreign demands that undermine Americans’ security.

Congress should also strengthen the safeguards in the Clarifying Lawful Overseas Use of Data (CLOUD) Act. Foreign governments should not enjoy privileged access to American technology providers while demanding measures that undermine encryption and cybersecurity. International cooperation in criminal investigations must include respect for the security and privacy of the American public.

Governments can support targeted investigations, judicial oversight, and effective policing while preserving the locks that protect everyone else.

In the final days of this election season, Global Encryption Day offers an opportunity for bipartisan leadership. Congress and the administration must make it clear to foreign governments that we intend to protect vulnerable families, defend American businesses, and stand with people struggling for freedom worldwide by safeguarding strong encryption.

The freedom to have a private conversation is an inherent right that belongs to all of us. Congress should ensure that this right survives the move from the park bench to the smartphone.

Bob Goodlatte is a former chairman of the House Judiciary Committee and senior policy advisor for the Project for Privacy and Surveillance Accountability.