“Any sufficiently advanced technology is indistinguishable from magic.” – Arthur C. Clarke
“Pay no attention to that man behind the curtain!” – The Wizard of Oz
Earlier this month, I had the pleasure of giving a guest lecture to a class at Stanford’s Graduate School of Business. I was asked to speak about the encryption debate as part of a course with the intriguing title, “Is the Internet Broken?”
The answer, of course, is yes. The Internet didn’t just become broken recently; it was never not broken to begin with (though maybe now it’s broken in different ways than before). And yet as a society we decided to hook it up to our commerce and finances and personal communications and critical infrastructure and, now, IoT toothbrushes and lightbulbs. That dependence means we are duty-bound to try to make it less broken.
So, in my guest talk, one of my goals was to impress upon the students that writing secure software is very hard, we are very bad at it, and it is stupid for governments to force companies to make it more broken by mandating they weaken their encryption or other security features.
I give some version of that spiel a lot. When I do, I always take law enforcement to task for refusing to give credence to the consensus of the last 25 years or more of security research: that we just don’t know how to make a secure backdoor. We know of no way to allow the “good guys” to access information in plaintext without also creating a vulnerability that the bad guys can and will find and exploit too (and that will probably create other unintended consequences throughout the system as well).
Law enforcement officials simply refuse to believe this. “I just don’t believe that it’s impossible,” said Chris Wray, the director of the FBI. “We put a man on the moon. … We have autonomous vehicles,” he said on another occasion. “And so the idea that we can’t solve this problem… I just don’t buy it.”
As Gizmodo summarized, in the view of Wray and his colleagues and predecessors such as James Comey, “the tech industry’s best and brightest are just being recalcitrant and could offer up a golden key for law enforcement to access encrypted communications if they really wanted to. After all, these are the people that created self-driving cars, the thinking goes. Why can’t they break encryption in a good way while they’re at it?”
I’ve made fun of this equivalence on multiple occasions, and I didn’t miss the opportunity to do so again in my B-school lecture. Self-driving cars! The moon! The comparisons aren’t even good ones—at least, not if you’re Valentin Bondarenko, the first fatality of the 1960s space race, or last year’s victim of a fatal Uber self-driving car accident in Arizona. When law enforcement invokes grand ideas of innovation and ingenuity as the rationale for disbelieving a quarter-century of actual research results, they’re blaming the people they see as magicians for withholding what they see as just another magic trick.
And yet… can you blame them?
Law enforcement didn’t come up with this “wizards and geniuses” mythos. It doesn’t do them any good. That mythos benefits Silicon Valley, and it’s Silicon Valley that’s been pushing that narrative. When tech companies “disrupt” another industry, when they demand reams of personal data about their users, when they replace government-provided public services with their own private-sector offerings, when they deploy new products created by a homogeneous set of young upper-middle-class white men from the same handful of universities, when they’re convincing you to spend hundreds or thousands of dollars on some gadget that will be obsolete in a couple of years—we’re supposed to go along with it, because they know better than we do. We just don’t comprehend their ingenious vision.
When Silicon Valley pushes this mythos so consistently, can you really blame law enforcement for going along with it? In the reckoning that tech has faced in recent times, these self-proclaimed geniuses’ inventions have been blamed for the destruction of everything from the copyright first-sale doctrine, to the American middle class, to democracy itself. Is it that irrational for law enforcement to suspect that maybe the nerds are smart enough to build a secure backdoor, but antisocial enough to refuse to?
Everyone wants to be seen as a genius when they’re raising Series B. Then, when you’re asked to do the impossible, suddenly you don’t want to be seen as a genius anymore. But don’t be surprised when you have trouble getting people to believe you.