• Preston Maness ☭
    link
    51 year ago

    Two points:

    1. There is a legal and (less so now than when the laws were originally written) practical distinction between telecommunications providers and online services. Telecom transports the messages, services create them. I suspect that they’re trying to say that there is no current legal precedent forcing online services to help the government decrypt communications. The gold standard here is end-to-end encryption, which is enabled by services at the endpoints of communication, Signal being the most popular. Currently (theoretically) the government cannot compel Signal to, say, push compromised versions of its software to targeted users that allows for surreptitious eavesdropping on messages that the user believes are end-to-end encrypted.
    2. Telecom companies, on the other hand, are required to let the government scoop up all of their traffic for analysis. In theory, all the government sees is encrypted garbage, at least for end-to-end encrypted communications. And some of the internal NSA documents from the Snowden leaks corroborate this at least. The NSA does not seem to have made any groundbreaking advancements in cryptanalysis that enable them to read whatever they want. However, other internal documents from those same leaks make it clear that the NSA is not completely powerless to decrypt these communications. Rather, they have to engage in TAO – Tailored Access Operations – that attack one or both endpoints of the desired end-to-end encrypted communication. It’s more expensive, difficult, and manual, but still possible.