Winter storm warnings continue in northern Minnesota 

MPR News helps you turn down the noise and build shared understanding. Turn up your support for this public resource and keep trusted journalism accessible to all. 

Turn Up Your Support

How do terrorists communicate to hide from investigators?

We know little about the means used by those involved in the deadly attacks in Paris, but intelligence and security officials have already launched a new wave of chatter about encryption.

 anonymous European officials were saying they believed the Paris attackers had used some kind of encrypted communication, "but offered no evidence."
Now NBC News is citing unnamed officials 

 "the ISIS geek squad is teaching terrorists how to use encryption and communication platforms like Silent Circle, Telegram and WhatsApp."
There was even a Forbes story that suggested the terrorists talked over Sony PlayStation 4, that has now 

One thing is clear: The investigation into the attacks is ongoing, and no specific evidence of encrypted or other communications has been confirmed.

Yet it has renewed the debate about encryption and the headaches that intelligence and law enforcement officials say it's created for their investigations.

What we're talking about is not your emails or Web searches, photos or social network posts. Those things get encrypted on your laptop and then decrypted and stored on a big corporate data server. There, law enforcement officials have the technical and legal ability to get access to the content, for instance, with a subpoena.

What's raising the concerns is so-called end-to-end encryption: when data gets encrypted on one device and only gets decrypted when it reaches the recipient's device. Think Apple iMessage, WhatsApp or FaceTime.


And for a while now, the law enforcement and intelligence communities in the United States, and to some extent in Europe, have been asking tech companies (which are pushing back) 

 basically a back door into these kinds of encrypted communications.


"From the law enforcement perspective, we describe this experience of going dark, that we no longer can penetrate the darkness to conduct our investigations," New York Police Commissioner Bill Bratton tells NPR's Ari Shapiro. "It's a very significant negative effect on our ability to detect and disrupt terrorist-related activity."

CIA Director John Brennan made this case against encryption on Monday at the Center for Strategic and International Studies in Washington:


The hand-wringing of course refers to the fallout of the 

, which showed, among other things, how the National Security Agency tapped into data centers and otherwise dealt with tech companies. That prompted a bigger push toward end-to-end encryption that would limit the companies' role in the surveillance process.
After months of debate, in October, the Obama administration 

 from the push for encryption back doors.


Some of the considerations were these: If America asked for back doors, what would stop China, Russia or any other country from demanding the same kind of access? Or, in light of massive hacks of government data, what would convince the companies that the federal agencies could properly protect the keys they'd be given?


"The reality is that if you have an open door in your software for the good guys, the bad guys get in there, too," Apple CEO Tim Cook 

 in October. "I don't support a back door for any government, ever."



In fact, the notion of law enforcement "going dark" in the face of new technology has floated since the 1990s and the dawn of the Internet, when law enforcement organizations pushed for access to communications services.

A group of computer scientists and security experts that had studied the topic then, reviewed it again in recent months and found high risk of unanticipated, hard-to-detect security flaws.


"We have found that the damage that could be caused by law enforcement exceptional access requirements would be even greater today than it would have been 20 years ago," they wrote in the abstract of 

 for the Massachusetts Institute of Technology.


Tech companies and privacy advocates also argue that the government doesn't need encryption back doors to carry out terrorism surveillance.

"Most consumer-oriented encryption systems that are deployed today protect the content of a message. They do no protect the metadata — they do not hide who is talking to whom," says Moxie Marlinspike, founder of Open-Whisper Systems that created TextSecure, the open-source encryption tool adopted by WhatsApp last year.

"So if you have a network of terrorists communicating with a known 'home base,' intelligence agencies will still be able to see that," he says.

Nate Cardozo, a lawyer on the civil liberties team at the Electronic Frontier Foundation, went even further, suggesting that the back-door push by the intelligence and law enforcement community is less about terrorism and more about collecting as much information as possible. He accused the CIA's Brennan of political opportunism — using the Paris tragedy to push for an existing agenda.

"We are in a golden age of surveillance. Right now it is easier for the CIA, the NSA, the FBI to surveil anyone, anytime, anywhere than it ever has been, even despite encryption," Cardozo tells All Tech.

"If we learned anything from the Snowden revelations, it's that the NSA and intelligence agencies around the world, including in France, are not suffering from the lack of information, rather they're suffering from the exact opposite. They have so much data that they're collecting, they have trouble filtering the signal from the noise."

And ultimately, he says, even if all existing encrypted devices got a back door, there would always be ways of circumventing those back doors — all it takes is a new app to restart the whack-a-mole.

"Trying to regulate encryption is like trying to regulate an idea," Marlinspike says. "It's going to be very difficult if not impossible to do."

Rep. Adam Schiff, the ranking Democrat on the House Intelligence Committee, summed it up this way:


"It's too early, I think, to say in terms of the attack in Paris to what extent these terrorist may have used encrypted communications," 

. "Even with the best of intelligence resources, there are still vulnerabilities and ultimately it's going to require us to eliminate that sanctuary in Iraq and Syria."  Copyright 2019 NPR. To see more, visit https://www.npr.org.

Crime, Law and Justice

Steve Henn

Author

Alina Selyukh

Security officials say the attacks are an example why law enforcement needs to access encrypted data. Privacy advocates and the tech industry say such "back doors" are not the best solution.

After Paris attacks, encrypted communication is back in spotlight

Go Deeper.

Like this?

News you can use in your inbox