To encrypt or not to encrypt - is not the question

Ben CreetA blog post from Ben Creet, Issues Manager at InternetNZ
26 June

This week the Five Eyes (US, UK, Canada, Australian and New Zealand signals intelligence agencies) are meeting and according to public statements they will be discussing UK and Australian proposals to "do something" about encryption (following statements from the British Prime Minister and Australian Attorney-General).

Encryption technologies exist to provide privacy and security for people and businesses all over the world. Many people and organisations are using encryption as it's a vital piece of technology that brings with it a number of security benefits. It provides increased privacy and security for people, no matter what their intentions or goals are.

Encryption debates are playing out across the world. Some organisations realise the privacy and security benefits encryption technologies allow – while others stating encryption is a tool allowing bad people to do bad things.

This is a conversation that we are really interested in and we think New Zealand needs to have it now in order to make decisions and keep New Zealanders safe both online and in general.

So we have written two papers about encryption – one explaining what it is, how it is used for good, how it is used for bad – and the other setting out what we think New Zealand needs to do in order to front foot this issue in a constructive way, rather than getting caught up in some of the international hysteria and silliness.

Encryption can't be "solved," you cannot "do something" about maths. However, law enforcement and national security agencies have legitimate fears and concerns, especially in a world which holds them to a standard of "never again." We want this entrenchment at either ends of the encryption debate to stop. Encryption isn't evil and it's not responsible for the actions of men. Technologists also need to climb down from the hill entitled "government is my adversary" and stop waving placards stating "you can pry my crypto from my cold dead hands."

This adversarial shouting match gets us nowhere as a society. We do not accept that solving challenges relating to encryption is a zero-sum endeavour, with one side gaining what the other side loses. Heck, I'm not truly convinced there are sides at all. We think there are options for increasing New Zealanders' security online and also addressing the concerns of law enforcement and national security agencies. We can, and should, all be trying to work together to realise the benefits of the Internet, protect its potential and keep our society safe.

We think the questions that need answers are:

  • Are Internet or information security benefits created by encryption seen as more valuable than the smaller number of national security risks that can be complicated by encryption? (Our opinion is yes.)
  • Can these risks be addressed through other means in order to realise the security benefits and wider economic and social benefits of encryption?

We think conversations need to happen in New Zealand to start gathering information and answering questions like these ones. To get this discussion kickstarted, we have written two papers about encryption.

  1. The first explaining what encryption is, how it is used across the Internet, how it is used for good and how it is used for bad.
  2. The second sets out what we think New Zealand needs to do in order to front foot this issue and not get left behind.

If you have any feedback about these documents, please let us know by emailing me (Ben Creet, Issues Manager) at ben@internetnz.net.nz.