One thing I love about watching the 2016 Crypto Wars: pro-encryption people using all of the pro-gun arguments. Here are my favorites:
1. Criminals will still use encryption / get guns. Only lawful people will be harmed.
2. Compromises will just lead to defeat for the pro-encryption / pro-gun side.
3. If we want to stand up for all of our other civil rights, we need the right to encrypt / bear arms.
4. Consequentialism: the number of people being harmed by encryption/guns is smaller than the number of people who would be harmed by living in a world without encryption/guns.
Personally, I think these are all solid arguments that work for both guns and encryption, but I'm generally more libertarian than many in the SF tech scene.
There's little risk your kid will get his hands on your encryption and do something immature that is also lethal; similarly there's little domestic violence you can commit in a rage with encryption.
A lack of faith in the absolute rationality of people is my argument against guns, and I include my own rationality there.
My argument for encryption is that tech is increasingly an extension of our minds, and we need to keep our mind private. I'm for encryption to the same degree that I'm against government use of a hypothetical mind scanner.
It is breaking encryption that is violent; that's the "gun" here, and it's one I'm against.
However, your premise is that it is possible to do something about guns.
However, consider the war on drugs, billions spent, agencies created, military style task force, severe penalties including life in prison just for possession.
So if that didn't keep drugs out of the hands of bad people, why would changing some regulations keep guns out of peoples hands? I don't see any regulations that have ever been proposed that would make any difference and if we went all in as in the war on drugs, but war on guns, the war on drugs sets a precedent that it won't be successful.
I'm not interested in a gun debate (besides, gun regulation works fairly well almost everywhere in the world, but drug regulation doesn't). This topic, however, is about encryption.
> gun regulation works fairly well almost everywhere in the world, but drug regulation doesn't
Problem is most of the countries with gun regulation where it has any form of success are also countries who didn't have guns to begin with.
Trying to impose that on a country with TONS of guns just isn't realistic. You can't even draw parallels between the two because the societies are far too different.
Your #2 is not specifically a pro-gun argument. Compromise on the death penalty, from an anti-death penalty advocate, means there will still be a death penalty. Compromise on prohibition, from a prohibitionist, means there will still be alcohol for sale. Compromise on allowing abortions, from someone thinks that abortion is murder, means there will still be murders. Compromise on slavery, from an abolitionist, means there will still be slaves. Compromise on the Taft-Hartley law, by Communist union officers forced to take an oath that they were not Communists and anti-Communist politicians, means that one of them can't get what they want.
In all cases, someone who compromised will view the compromise as a defeat.
Therefore, you can't really say it's a pro-gun argument per se, but that both are examples of a wide class of arguments.
I feel that holds for the rest of your points - they hold for nearly every argument, and aren't specifically pro-gun or pro-encryption.
For an example of #3, the US Supreme Court in Roe v. Wade says abortions are legal due to a right of privacy. Those who want to restrict or eliminate abortions view it as a right to life of the unborn, and believe the Court was incorrect in making their decision. Both sides base their arguments in civil rights.
Also, I think the comparison of cryptography to guns is not a good one.
If you want to think of cryptography as a munition, then it's much more like armor than it is to a gun. Bulletproof vests are sometimes used when committing a crime. There are also some laws against them.
And in the US, bulletproof vests are not, I believe, covered under the Second Amendment.
The really interesting thing about point 1 is that with encryption, there's really extremely little personal risk to being unlawful when it comes to encryption. That's why this is a losing game of chess for them. Encryption is just math, and you don't need anybody's permission to do math. You can take a system that the government has mandated be broken and you can do good encryption inside that system by layering it. And good people who simply want to be safe will do this. And so will terrorists. Outlaw good encryption and a whole sub-industry of deniable encryption tools will emerge. And they will have achieved nothing except that our companies won't be allowed to officially support strong encryption, so they'll be disadvantaged in the marketplace. It's a really backwards move.
If your hardware contains unflashable firmware with a back door to direct memory access, then there is no encryption you can trust to perform on the device itself. For example, your baseband processor in your mobile phone which is a binary blob, protected/signed so not to violate FCC regulations and disrupt networks.
Such firmware can be mandated from manufacturers without outlawing encryption directly but making it useless nevertheless.
> Such firmware can be mandated from manufacturers without outlawing encryption directly but making it useless nevertheless.
So the obvious first response to this is that it doesn't actually work. Have you seen the security of these vendors? Apple takes it more seriously than most because they're using it to maintain control over the App Store and yet people still root iPhones. Mandate it by law on vendors who don't even want to do it and it will be completely broken in two days. And completely broken against not only the user. Let's not forget the situation with wifi routers -- "only the manufacturer can issue updates" quickly turns into "security updates are not available from anyone anymore" with the consequent catastrophic nightmare following directly.
But let's pretend we're uninformed pedestrians who don't know that for a minute. How is this idea not even more outrageous than banning encryption to begin with?
it is politically more palpable and "sounds" less outrageous to the public than outlawing encryption. which means it is more likely to make it into law and get support.
The ability for any software to reliably recognize whether an encryption algorithm is being performed or not is not possible (not computable). It can always be hidden.
Yes. And you can obfuscate it. You can even encode it using packet timing, which is very hard to detect. It's also very inefficient, on the order of 1%, but that's enough for text over HD video. See True Names by Vernor Vinge.
> Consider that, as it is now, encrypted data on the Internet traverses numerous untrusted devices
And those untrusted devices leak considerable amounts of that data! You know that it doesn't matter how good the encryption is if one of the computers in the chain is full of malware.
For your OTP example: I know what the cipher text is. I slurped that. I don't know what the key is, or the plain text is, until you decrypt it, at which point I know both because I have access to your memory because your computer is compromised.
My point is that compartmentalization allows secure communication through untrusted devices. It won't be convenient, but it's doable. There is no "computer". There are local networks of suitably isolated devices.
The device that decrypts can't send anything to the Internet, because it's behind receive-only optoisolators. The device that encrypts can't receive anything from the Internet, because it's behind send-only optoisolators. All intervening information processing may occur in your head. Or there may be other devices that are totally air-gapped, with all data transfer through single use flash storage. If you're using entirely untrusted devices, you move all crypto to such air-gapped devices.
It does help if these devices can be trusted, but that's not essential. You could, for example, do encryption manually with one-time pads. Or use that thing with decks of cards.
Maybe you claim that no trustable devices will be available. But that's unlikely. Consider how easy it is to obtain Afghani heroin in NYC. Also, if I were targeted by American adversaries, I could arguably trust devices backdoored by the Russians, or the North Koreans, etc. And vice versa.
Mostly because I believe the device can be more cheaply made if it does not have to run a full-featured OS such as Android. No browser, no color screen, just like my old Nokia candy bar phone; no GPU at all would be required.
1. The majority of the time, encryption is used for legal, positive reasons, like protecting your bank info or medical info. Guns, on the other hand, there's no argument for: just look at the data from the UK. Even the police are better off without guns.
2. This might be true for guns, but who cares?
3. In the age of tanks, machine guns, and grenades, consumer guns don't enable us to overthrow unjust governments as they did when the bill of rights was written. As such, they no longer play a role in protecting our civil rights. If anything, gun rights are frequently a talking point for Right-wing politicians who happily trample over all of our other civil liberties. As a political force, the pro-gun politics is actively harming our civil liberties.
4. Looking at the data, I don't see how your can argue this. In the US guns are used more in suicide or commission of a crime than in self-defense. In the UK, near-universal bans on guns have lead to a drastic decrease in gun deaths.
> The majority of the time, encryption is used for legal, positive reasons, like protecting your bank info or medical info. Guns, on the other hand, there's no argument for
Ummm, the vast, vast majority of the guns in the U.S. are used for legal, positive reasons like target shooting or self-defense. The number of murders per gun-year is incredibly low, effectively infinitesimal.
Focusing on murders really misses the point. Or rather misses the full picture. Something we rarely talk about but is the biggest gun problem in the US.
60ish percent of deaths by firearms are suicide. Owning a firearm is a risk factor for suicide. This is because many (most?) suicides are not carefully planned out and given considerable deliberation but are somewhat impulsive. Removing an easy means to commit suicide actually reduces suicide.
Where did I say I wanted the government to criminalize gun ownership to prevent suicide? I didn't. I specifically said I don't have an opinion on the matter. I just said we shouldn't focus on murders being the biggest problem because they aren't, suicide is.
When a gun fires at a human, it is a suicide or a murder more often than it is self defense.
Ultimately, though, I do agree that these numbers are all negligible: there are more car deaths annually than there have been civilian gun deaths in the last ten years. The argument that is important to me is that gun rights simply aren't very relevant any more, and they are being used as a talking point for political forces who are causing a lot of harm to much more relevant rights.
re: 1. The majority of the time, guns are not used at all. Most of the rest of the time they're used for legal, positive reasons, like protecting your bank or recreation. Guns, there's just no way to prevent or collect them all (no way that's consistent with the US Bill of Rights, even if you toss out the Second Amendment). You really don't need much machinery to make an improvised gun, and with a little more tools and expertise, one can manufacture an automatic weapon.
>just look at the data from the UK. Even the police are better off without guns.
I'm more afraid of harm from police than I am from criminals with guns.
>2. This might be true for guns, but who cares?
Meh, it's not a great point but a lot of people in the US care, even if you don't agree with them.
>3. In the age of tanks, machine guns, and grenades, consumer guns don't enable us to overthrow unjust governments as they did when the bill of rights was written.
Tanks are literally useless. As the wars in the Middle East have nicely demonstrated, they do not magically enable victory, especially against an entranched/integrated guerrilla enemy. This is true for all sorts of high-tech military weaponry/machinery.
>As such, they no longer play a role in protecting our civil rights.
I disagree with the premise of your argument, so I also disagree with this point.
>If anything, gun rights are frequently a talking point for Right-wing politicians who happily trample over all of our other civil liberties. As a political force, the pro-gun politics is actively harming our civil liberties.
I can agree with that. There are a lot of authoritarians/fascists/logically challenged people on the pro-gun side; and a lot of politicians who use divisive issues to agitate the more excitable parts of the electorate. They do it for abortion and LGBT/civil rights as well. It's not great, but also not an argument for/against gun rights.
>4. Looking at the data, I don't see how your can argue this.
I don't see how the US gov't can effectively collect all of the guns in the US without some pretty draconian/authoritarian measures of exactly the type that pro-2A folks oppose in principle, and that most Americans agree with.
>In the US guns are used more in suicide
I don't want a government to try to prevent me or anyone else from suicide by trying to nerf the environment.
> or commission of a crime than in self-defense. In the UK, near-universal bans on guns have lead to a drastic decrease in gun deaths.
I admit the numbers are hard to argue with, even factoring in the violent crimes committed with other weapons and against the unarmed. OTOH, I've noted a disturbing trend of the UK to ban or attempt to ban or regulate the sale of other items which may sometimes be used as a weapon, mainly pointy things like kitchen cutlery. That's certainly not something I would support.
As an analogy, note that the US has attempted to prevent the distribution of illegal amphetamines by restricting the sale of so-called precursor chemicals. It hasn't prevented the distribution of methamphetamine, but it has prevented the retail sale of drain cleaner, cold medicine, and other household chemicals/items. It's a moderate inconvenience for a lot of people and the only discernible effect it's had on drugs distribution is to decrease the quality/safety of illegal drugs (through criminals using inferior methods to produce them). Gun culture is so ingrained in the US that I feel we'd see the same sort of things happening with guns if the gov't attempted to ban them.
They become pretty weak for encryption except #1. Moreover, there are real arguments for the inherit danger in owning a gun, statistically. It's a fact that you're more likely to commit suicide or someone gets killed because you own a gun.
You can't say the same about encryption because it's a tool, not a weapon. A gun is a weapon meant to kill.
> 2. Compromises will just lead to defeat for the pro-encryption / pro-gun side.
A compromise in encryption hurts everybody. The whole platform for electronic banking needs strong encryption, for example.
> Consequentialism: the number of people being harmed by encryption/guns is smaller than the number of people who would be harmed by living in a world without encryption/guns.
If you own a gun you are statistically more likely to get shot or killed.
> If you own a gun you are statistically more likely to get shot or killed.
Or is it that if you have reason to believe you might get shot or killed, you are more likely to buy a gun?
I don't have an account, but I just made one because I'm genuinely curious about whether you have a good source for this claim. The usual study referenced for this is deeply flawed; if I remember correctly it examines people who were shot and checks whether they owned a gun. Of course that study is completely invalid because of the selection bias involved. P(X owns a gun | X gets shot) is not the same as P(X gets shot | X owns a gun).
While agreeing with you that there are some statistically terrible high profile studies (such as failure to control for cases where the subject acquired a gun explicitly because they thought someone was planning to shoot them), I think it is still true that owning a gun causally increases your likelihood of being shot.
The biggest reason is suicide. If you don't own a gun, you are much less likely to intentionally shoot yourself. The second reason is accidental shootings. If there is no gun in your house, there is practically no chance that you will accidentally shoot yourself, or that your toddler will accidentally shoot you.
Of course, the question that's really being asked is whether an individual is at greater risk of being shot intentionally by someone else if they own a gun or not. This is where the data is much thinner. This seems like a solid review article: http://www.iansa.org/system/files/Risks%20and%20Benefits%20o...
Their conclusion at the bottom of page 4 and top of page 5 is even after "controlling for illicit drug use, fights, arrests, living alone, and whether or not the home was rented", that "Yes, owning a gun increases your risk of death by gunshot". Still, I'd be interested in seeing a study that breaks apart statistics for hand guns and long guns.
That's an oversimplification. While it's true that criminals will still get encryption, there's no corresponding harm to innocents like there is with widespread gun ownership (domestic violence, fights that escalate into shootings, child accidents, adult accidents, etc.) It is not as "solid" an argument for guns as it is for encryption.
> ...there's no corresponding harm to innocents like there is with widespread gun ownership...
That is also an oversimplification. Have you considered the possibility that encryption can be used in commission of a non-victemless crime? Let me direct your attention to the state's now second favorite goto: child porn. Privacy advocates are as familiar with that justification as gunrights advocates are with the waving of bloody shirts following school shootings.
The difference is that it is for all practical purposes impossible to actually ban strong encryption, because it is a virtual good; it is a mathematical concept, implemented in a lot of widely available open source code. At most you can legislate that stock computing devices (such as smartphones) contain no such strong encryption without government backdoors, and you would be able to catch the low hanging fruit of the criminals depending on that technology.
But you cannot prevent someone from using strong encryption using third party applications. How will you force a backdoor into, say, gnupg or dm-crypt? Outlaw that software? Any criminal worth his salt will use tools that are not backdoored, completely negating the gimped government-approved stock software.
Guns are physical items that require physical ammunition. It is a completely different situation. This discussion and comparison is also very strange for someone from Europe, where owning a gun is rare and completely undesirable for the vast majority.
I don't mind taking the conversation in a different direction, but I just want to make it clear that nothing you said has anything to do with what I said.
> ...for all practical purposes impossible to actually ban strong encryption...
They learned their lesson after the first attempt to do so. Just jumble those words up a little and you'll see the current strategy: actually ban practical encryption. The state doesn't care about gnupg, or any other software that requires more than an hour's worth reading to safely use - because 99% of people won't. So they only have to target the stuff that is easy to use or on by default... unless they can depend on corporate cooperation (Apple up until recently, Microsoft, AT&T, etc).
> Guns are physical items that require physical ammunition. It is a completely different situation.
One can very easily manufacture a firearm using the same equipment that one would use to produce common consumer products like garden hose nozzles. The schematics are all available online. The state doesn't ban the means of production, they ban the stuff that makes it accessible to the common folk - like retail sale of firearms. You see where I'm going with this right? The state doesn't ban math, they ban the stuff that makes the math accessible to the common folk.
> ...where owning a gun is rare and completely undesirable for the vast majority...
lol, unlike encryption software? I'm not talking about the kind that lets you buy crap online that the state can easily circumvent, I'm talking about to kind of crypto that only terrorists, pedos and anarchists want to use... and that the state can't break.
The kind of encryption that we use to safely buy stuff on-line (such as TLS for securing our HTTP connections) and the kind that security-aware people use to secure data (which includes criminals and anarchists, but also activists living under repressive regimes, healthcare professionals, lawyers, software developers, etc.) is quite similar from a mathematical standpoint. The underlying algorithms (such as AES, SHA-2, RSA, etc.) and mathematical concepts are often the same.
There is no practical difference in the kind of crypto a criminal uses and the kind you would use to store your passwords and scans of important documents.
Again... there is very little material difference between a garden hose nozzle and a 1911 handgun, just as there is very little mathematical difference between the functions powering TLS and PGP. But one is completely centralized and offers practically zero protection from government lawyers and NSLs, and the other offers protection from even determined state level adversaries. Guess which one is widely deployed and which one had to be published in a book and shipped over seas in order to circumvent munition export restrictions.
Exactly, because obviously 3d printed objects are not, in fact, physical objects that require physical ammunition and that can be treated like any other physical object, right? Right?!
You know that the majority of stuff you see on CSI is total crap... There are three identifying marks on spent shell casings:
Fingerprints: easily avoided.
Production facility/year: not really useful for criminal investigations.
Toolmarks from firing pin and extractor: oversold television crap, toolmark analysis is quickly sinking to the same level of reputation as bitemark analysis in the real world.
None of that matters for anything that doesn't eject spent shells, but nobody would choose to print a more easily produced revolver, derringer, liberator, muzzle loader - right? Right?!
I don't know what you are arguing here. A gun is a physical item, as is ammunition. You can stop somebody, search them, and find out if they have a gun and/or ammunition. You cannot do any such thing with encryption, as it is not a physical entity. Whether your gun is a regular gun, 3d printed or made of candy cane does not change the fact that it is a physical item. I don't care where it comes from or how you built it, as a physical item, it still follows a very different logic than virtual entities.
Ah, given the context my mind went right to ammunition microstamping.
Encryption software and 3d printed guns are simply implementations of ideas, both physically interact with the world and both can be observed. ABS plastic stock is to blank hard drive as printed gun is to c:/pgp.exe.
You missed the point. Widespread gun ownership among non-criminals has side effects that harm innocents. Not the case with encryption.
You could argue it makes it easier for people to become criminals, but even that is a weak comparison. Guns are a lot harder to come by in the UK (for example) than encryption software would be in a more regulated world.
You hid the point pretty well then, because those who engage in "domestic violence" and "fights that escalate into _blank_" are certainly not "non-criminals". So that leaves only accidents:
Widespread $PHYSICALOBJECT ownership among non-criminals has side effects that harm innocents. Not the case with $VIRTUALOBJECT.
You know that regardless of what you use for $PHYSICALOBJECT or $VIRTUALOBJECT that statement will be true right? You also did not state exclusivity among non-criminals, is that because you know that is impossible? If that is the case then you've hidden the point very well.
I largely agree with you as far as rhetoric goes, but I think there are practical details of guns & encryption that matter in practice. First, guns are physical things where encryption is (largely) ideas. Second, the 'protection' offered by the two technologies differs. Guns offer a dis-incentive to mistreat the user, but do not directly restrict behavior when at rest. On the other hand, encryption prevents access even if the user is un-aware, but does not offer any method of 'active' defense (i.e. shooting at an aggressor).
Devil's advocate. Brandishing a firearm i.e. displaying but not drawing it could be considered an 'inactive' defense. Knowing someone owns an iPhone might dissuade one from attempting theft.
> First, guns are physical things where encryption is (largely) ideas.
I don't see what this means for the topic at hand.
> Second, the 'protection' offered by the two technologies differs. Guns offer a dis-incentive to mistreat the user, but do not directly restrict behavior when at rest.
Same here. What's the significance? Would auto-firing guns be better?
On a practical level, it's more difficult to interdict and regulate non-physical things. There is a potential future where 3d printers are good enough and universal enough that guns are knowlege too - but that's not the situation today. How easy a thing is to regulate matters enormously to how actively you want to pursue it.
The difference is that guns require the user to engage others with the gun to be effective. This is how people pull guns on the police who are breaking into their houses and get shot, this is how people hurt themselves while practicing with their guns, etc. Even if everyone has the best of intentions, there is still potential for injury or death. Good intentions are not enough, perfect use of guns is also necessary.
Poor use of encryption, on the other hand, has the opposite effect. Poorly encrypted documents are simply insecure - bad but not injurious. On the other hand, correctly encrypted documents are simply in-accessible. While guns are objects that are fundamentally about affecting other things ("If you do X, I will shoot you"), encryption is fundamentally about affecting the thing that's encrypted.
I suppose I meant that the stakes are lower with encryption. If someone gets encryption and doesn't know how to use it, they simply incorrectly encrypt their stuff. If someone gets a gun and doesn't know how to use it, they may hurt themselves or others. incorrectly encrypted documents may hurt people, but it's not inherent to the encryption.
This doesn't sound as crazy as it might at first glance, once you remember that strong encryption used to be treated as munition, and in some ways still is.
There is plenty of weaponry that is restricted despite the second amendment. The US public gets pretty antsy when smallarms get restricted, but they don't say much when states start banning civilian-owned things like tanks, landmines, maces, or even brass knuckles.
Hell, the US even invaded Iraq for the official reason that 'Iraq had weapons you weren't supposed to have' (chemical weapons). Yes, Iraq is not subject to the US constitution, but the concept of 'some weapons are okay, others are not' is still there.
> There is plenty of weaponry that is restricted despite the second amendment. The US public gets pretty antsy when smallarms get restricted, but they don't say much when states start banning civilian-owned things like tanks, landmines, maces, or even brass knuckles.
Those laws are violations of any honest reading of the Second Amendment (with the possible exception of tanks, if one thinks that the Second Amendment protects only man-portable weapons).
You're right to point out the similarities, but when you drag guns into this issue you lose some supporters.
It unnecessarily complicates the issue, even though I agree with you on the similarities. People will just find more ways to disagree on encryption and they won't have learned anything more about computer technology.
The only difference is that more people use encryption then guns.
And what affects me is most important, morals be damned. /s
Majority oppression is very effective. And that's why I think this will turn out differently than guns. My prediction: you won't have to register encryption keys, or keep it disabled, or pay the state some ridiculous amount for a permit that they illegally stonewall, or be prevented from using any encryption made after 1986.
Replace "encryption" with any of cars, knives, food, rat poison, drain cleaner, plastic wrap, dogs, lasers, urine, syringes, air, water, concrete, VCRs ... to see why this is an inconsequential point.
Yeah I agree, I just think there's something a bit more visceral about shooting someone with a gun (or using any other physical weapon that shoots or cuts or stabs) rather than using encryption to set up a scenario that would cause harm in some way indirectly from the perpetrator.
I would think this is why there are those restrictions on guns that seem pretty weird when you talk about applying the same rules to encryption.
What do you think would happen if someone planted cryptolocker-inspired malware on a planes avionics suite and denies it's use to the flight crew? Especially one of the newer models which are exclusively fly-by-wire?
Cryptolocker attacks have very little to do ideologically with encryption; it's a side show to the main event, the fact that networks are vulnerable to infiltration. Those attacks could happen with or without encryption in the malware, but could be reduced in frequency and severity by using strong systems with strong encryption on the victims' side.
The airplane bit is where the scenario goes completely off the rails wrt encryption's involvement, but again, using encryption and strong security on the airplane's systems would reduce or eliminate the risk.
I guess then the next time someone (perhaps even yourself) argues "they're trying to take our guns away" you will point to the 2016 Crypto Wars to show them that they're wrong...
It's entirely reasonable to argue that some of these arguments apply to encryption, but not to guns, as the actual arguments that are usually used are more complex.
Applying an argument to something physical vs. something digital or something that directly kills people vs. something that prevents access to information makes a lot of difference.
#3: Ironically, the pro-gun people that argue this never actually use this supposed right. You hear that the second amendment is the protector of the others, yet most of the rest of the US Bill of Rights get some significant erosions without so much as a peep of second-amendment reaction.
Perhaps they're waiting for the 3rd and 7th amendments to suffer like the others, so they can react to the complete set in one go? Certainly the 4th, 6th, and 8th amendments have taken quite a pounding in the past couple of decades...
1. Criminals will still use encryption / get guns. Only lawful people will be harmed.
2. Compromises will just lead to defeat for the pro-encryption / pro-gun side.
3. If we want to stand up for all of our other civil rights, we need the right to encrypt / bear arms.
4. Consequentialism: the number of people being harmed by encryption/guns is smaller than the number of people who would be harmed by living in a world without encryption/guns.
Personally, I think these are all solid arguments that work for both guns and encryption, but I'm generally more libertarian than many in the SF tech scene.