Official abuse of state security has always been bad, now it’s horrifying – Source: go.theregister.com

Opinion The UK government’s attempts to worm into Apple’s core end-to-end encryption were set back last week when the country’s Home Office failed in its bid to keep them secret on national security grounds.

Or so we think: the whole business has been massively obfuscated by that special blend of state secrecy and legal gaggery that characterizes an official attempt to do something we really need to know about without telling us. Sooner or later, that scent escapes the kitchen and we know something’s cooking. 

In this case, although nobody actually involved would or could say anything, privacy campaigners and journalists got wind that the UK’s Home Office had issued a secret demand that Apple put a back door into its top level none-but-you-and-God iCloud secrecy. Rather than comply, Apple yanked the capability from British users, an action far more eloquent than a press release. It also – we think – appealed the original order. We only think this, because any such appeal can also be secret if the Home Secretary says it should be, and a special independent tribunal agrees with them. 

Last week, the tribunal decided this was a bad idea, denying the official request for a secret court. The tribunal also said it didn’t want to say no because it really likes the Home Office (the UK version of Homeland Security), which says a lot about its independence and the weakness of the government’s case. As this case will rest on two impossible things, 1) that any backdoor can be kept secret and 2) that state cybersecurity guarding it will be perfect, sinking our teeth into that nugget of truth will be tasty. 

Which is good. Secret courts have no place in a democracy. They are officially excused because of cases involving official secrets that would be compromised if produced in open court. But if the case is that the defendant has compromised that information, then it’s already compromised, presumably to the very people the secret court is trying to keep in the dark. Otherwise, make the case in public. 

Details vary by jurisdiction, but individuals at risk can be kept anonymous, evidence produced with redactions, records kept under seal, and so on, but all these are visible and amenable to challenge. It is to the UK’s credit that its own secret courts can be unzipped and to its discredit that they exist at all. If you can’t prosecute in public, don’t prosecute at all. It galls that the guilty go free, but the ability to hide sins at the expense of innocence weighs much heavier. The cover-up is worse than the crime, and secret courts provide a banquet of opportunity for that. 

In fact, abusing the mechanisms of state security is such a good indicator of bad behavior, it could and should be a crime in its own right.

The dark gothic manoeuvers of US President Donald Trump in shutting down criticism seemingly by a combination of punishment by diktat and perverting the invocation of freedom of speech is an exemplar for the ages. He didn’t like that there was no evidence of interference with the 2020 US presidential election he lost to Joe Biden, and he especially didn’t like that CISA, the cybersecurity agency he asked to produce such evidence, said it couldn’t because there wasn’t any. In the few weeks left to him at the time, he fired the agency head, Chris Krebs. Now he’s back, he’s opening a criminal investigation on whether Krebs suppressed freedom of speech by working with social media to reduce misinformation, and revoking not only Krebs’ security clearance but that of the entire organization he set up after he was fired. 

The freedom of speech abuse is bad enough: social media companies constantly promote and downrate what people say in them by unregulated and invisible algorithms, and set rules of acceptable content that users can agree to or go elsewhere. You can say what you like, there’s no legal compulsion on a publisher to accept or amplify it.

Krebs had no legal power to compel anything here, but a duty to understand and discuss with the companies the harmful effects that deliberate disinformation campaigns could have on the security of the US. By removing his security clearance, and the security clearances within his company, Trump is not only removing his livelihood and thus his ability to defend himself, but sending a chilling message to anyone else who might put duty to truth above loyalty to the Beautiful Leader.

Security classification is more complex and nuanced than you might think. It’s open to abuse. Its use as a direct, open and shameless weapon of persecution against personal disloyalty is new and heinous. 

• Apple’s alleged UK encryption battle sparks political and privacy backlash
• Just declassified: US senator caught up in Section 702 FBI surveillance dragnet
• 10 years after Snowden’s first leak, what have we learned?
• No day in court: US Foreign Intelligence Surveillance Court rulings will stay a secret

The closest analogy is how the House Un-American Activities Committee under Senator Joseph McCarthy persecuted thousands of people in the mid-decades of the last century for the presumed crime of being communists through innuendo and denouncements. While this was a perversion of government power and McCarthy ended up censured, and although it harmed individuals and America, at the time it enjoyed the figleaves of process and the excuse of a known hostile ideology. Trump’s action is one man using the state to attack anyone he feels like, unfiltered, while musing openly about setting the Constitution aside, and using primary tools like funding and security clearance to escape oversight and control. That’s an order of magnitude worse. 

Both this and the attempt by the UK government to hush up its mistaken assumption that state security can be made perfect are abuses of security, made in the assumption that there is no comeback. That the nature of security in the digital age has changed is reflected by many new laws of the past 40 years. That this new nature puts extra responsibilities on those who ultimately control it has not.

We need recognition that abuse of the mechanisms of security by the state has much greater consequences now than before, legal recognition with teeth. It may not stop such abuse, but it would be a powerful tool to counter it when it happens.

Digital secrecy is a new and powerful beast that is only now revealing itself. We must know its nature, and how best to tame it. ®