I personally think that creating laws to prevent government surveillance is a pointless endeavor. The NSA has ignored and broken laws in the past, why would we expect them to follow new ones that are passed?
The only way to prevent surveillance is with a technical solution (encryption), not a legal solution (more laws).
You need both. By that same logic do you think the constitution and bill of rights is a pointless endeavor? Our government has violated these rights many times in our history. I could just as easily say that the constitutional amendments passed after the civil war were pointless because there was still institutionalized discrimination and racism for another hundred years.
How much did encryption help Lavabit? The court forced them to hand over the encryption keys anyway.
We need to change the laws and place proper oversight over the NSA and other intelligence agencies with real penalties for the violation of our rights. Encryption alone is not enough.
>with real penalties for the violation of our rights.
This. The flagrant violations of our constitution that have taken place are tantamount to treason and the guilty parties deserve punishment at the level of life in prison. And I will vote for any candidate that has the intestinal fortitude to say so.
> How much did encryption help Lavabit? The court forced them to hand over the encryption keys anyway.
Lavabit has a pretty bad system because it did not take the law into account at all and was run by someone that does not seem to understand legal concepts very well. From what I understand, the court that forced them was not FISA, but a plain old federal trial court. Please correct me if I'm wrong.
Furthermore, even the best encryption does little to prevent meta data and anonymity networks ala Tor are inherently high latency and low throughput.
What's more, people tend to prefer centralised systems at the moment, for the sake usability. E.g., I don't see how Androids automatic photo backup could be as friction-less otherwise.
If the NSA's domestic spying is illegal, it's only on a technicality. Congress explicitly authorizes it, and the Supreme Court explicitly finds that the 4th amendment doesn't protect 3rd party records. I'm sure it's violated some specific regulations here and there, but on the whole, spying on everything everyone says and does is not illegal.
The 3rd Party Doctrine made sense when you were physically handing something to somebody else or whispering something in somebody else's ear. In today's world, its interpretation is ludicrously antiquated.
Unfortunately, I don't forsee Congress doing much to solve this any time soon.
Fortunately. Only battles hard-fought are valued. If congress caved for a few years until this blew over, nothing would really change. And ultimately only strong client-side communication schemes (encryption+identity+etc) will solve the problem. Which is something that has a cost people must bear but that they will not if they don't understand the issue.
TL;DR - If congress made it "illegal" it wouldn't change anything. That they refuse to, will change everything.
Also, the third-party doctrine is sort of a recognition of the right the blow the whistle on crimes you see. It's not even (generally) a bad thing. It's only our government's too-cozy of a relationship with too much of the industry that means it's not whistle-blowing but twisted-arm leaks.
It doesn't matter if the actions of the government are (by some technicality we wouldn't accept from a five-year old) legal, if we don't want that behavior anyways.
Government rules by the mandate of the people. And we don't owe it a n-year mandate, or the completion of a grand plan, or trust, etc. When it steps out of line it is illegitimate despite its "legality" in its own laws.
It costs political capital to ignore the law. Dig into the leaks that have come out. Why so much talk about meta data and U.S. persons and minimization? If they were just ignoring the law, they wouldn't bother with any of that. They do it because the law gives them leeway along certain dimensions, and it costs them much less political capital if they can justify their activities as sticking to those rules.
Technical solutions can and will be made illegal once they become a significant impedance to what the government wants to do, preventing the vast majority of people from using them.
Encryption does not prevent surveillance, it just means surveillance changes to more watching people and devices and less watching traffic. You can use all the end to end encryption you want, it does you no good when the ends are insecure.
The encryption game is rigged since the NSA and other government actors are able to use public funds to sabotage it. So the legal angle is still important.
Agreed. With the ability to carry out correlation attacks and the proven information content of metadata, encryption can't provide a complete "technological solution."
I personally fear that it might be equally pointless to try to encrypt your data.
There are just too many point of failures.
Some futurists like David Brin have been pushing the idea that encryption will ultimately fail and that sousveillance and a push for transparency were the only adapted responses.
I think it would be interesting to push in that direction (it does not prevent from trying to encrypt your data as well).
The only way to prevent surveillance is with a technical solution (encryption), not a legal solution (more laws).
I'd say both have their place however focus on protecting the legality of encryption, not on making it illegal to spy. Bolster security by design with law, don't use law to haphazardly stop spooks from doing spooky things.
The problem isn't necessary the laws, but the fact that there never seems to be any punishment for abuses, so the NSA just learns the laws don't apply to them, and keep doing whatever they want. If our representatives actually punished them, we'd be in a different situation.
This is one of the few cases where "starve the beast" makes sense: there is a large entrenched power structure responsible for this, and the public is paying for it. A budgetary line of attack can work as well.
It adds complexity, but it ultimately isn't really particularly difficult.
The problem is that your backend servers can no longer operate on that data in any meaningful way. For this reason, full end-to-end encryption is likely not realistic for certain applications.
Simpler applications, like iMessage, can and do implement end-to-end encryption without much difficulty at all.
The NSA is a military organization, and arguably does not consider itself to be bound by domestic law. After all, the US is perpetually at war. But the legal environment can limit the NSA's options for using intelligence. When efforts must remain secret, there's more need for parallel construction.
The only way to prevent surveillance is with a technical solution (encryption), not a legal solution (more laws).