海角大神

When Homeland Security Secretary听Jeh Johnson arrived in San Francisco for one of the world鈥檚 largest technology conferences, it was almost like a foreign emissary听entering enemy territory.

The epicenter of the听country鈥檚 technology community has been openly hostile toward its government ever since whistleblower-turned-fugitive Edward Snowden revealed two years ago the National Security Agency was collecting troves听of Americans鈥� communications records and hacking into the Internet backbone. Mr. Johnson had arrived at the RSA Conference, an annual gathering of thousands of influential cybersecurity professionals, with an olive branch. He sought to encourage collaboration between Washington and the nation鈥檚 tech industry, including by announcing a听new Homeland Security office to work with what he called 鈥渇riends鈥� in Silicon Valley.

But it wasn鈥檛 just the long shadow of the Snowden revelations that Johnson had to overcome. Another battle between the Obama administration and the tech community was just beginning to heat up, as senior US officials called on major tech companies such as Apple and Google to weaken听encryption technology so that law enforcement and national security agencies have easier access to their听customers鈥� data.

After the Snowden leaks, those companies听moved to听deploy stronger default encryption on products such as the iPhone or Android operating system, sparking the ire of听national security officials.

鈥淓ncryption is making it harder for your government to find criminal activity, and potential terrorist activity,鈥� Johnson told the conference in late April, echoing National Security Agency chief Adm. Mike Rogers and FBI Director James Comey, who want companies to build into their products a secure channel for the US government to access the encrypted data. 鈥淲e need your help to find the solution,鈥� Johnson said.

However, to an audience of security professionals whose careers depend entirely on their ability to secure software and hardware听products 鈥� and whose fervor for protecting them from criminal听hackers borders on religious 鈥� Johnson鈥檚 call for cooperation was pure heresy.听To them, purposefully building in what they see as a vulnerability into otherwise strong security measures so someone, even the US government,听can more easily access people鈥檚 information is anathema.听

And听just bad business.

鈥淟et鈥檚 take away the emotion for a moment,鈥� says Scott Montgomery, vice president and chief technology strategist for Intel Security. 鈥淚magine you want to protect your house, and I鈥檓 going to sell you a deadbolt. That deadbolt is absolutely perfect. It鈥檚 the best deadbolt that鈥檚 ever been made. No one can break in 鈥� . Except, I鈥檝e put in one method by which someone can break in.鈥�

He asks: 鈥淲ould you buy it?鈥�

The answer, Mr. Montgomery and many other senior industry officials feel, is unequivocally: No.

Now, companies and technology advocacy groups are vehemently arguing against the back听door proposal at industry meetings, public forums, and in private meetings at the highest levels in government.

The fray has reached the highest ranks of the White House. President Obama is still deciding his position, sources say, and his administration is divided 鈥� despite the strong stands from the national security apparatus in recent weeks that have led some observers to believe the US government position is unified. (Mr.听Comey, for instance, will head to the Senate听听补苍诲听听committees on Wednesday听to make his听case听for why听the proliferation of commercial encryption is challenging the FBI鈥檚 lawful investigative tools.) While none of the dissenting officials appear to听have opposed high-profile advocates such as Comey in public, behind the scenes, sources say,听Obama鈥檚 advisers have been preparing a range of policy options for the president to review.听

During this process, encryption has become so controversial that many people are unwilling to expound upon the debate on the record. Yet this article, which relies on interviews on and off record from more than two dozen officials from tech and security companies across the country, reveals the American business community worries such a policy, if enacted, would threaten the competitiveness of their businesses.听

They are concerned听it would unnecessarily put their customers鈥� personal security and privacy at risk as criminal hackers grow increasingly sophisticated and governments seek to eavesdrop. At the same time, many companies are already听trying to estimate the high听cost听of听dealing with any regulation that would mandate access to encryption 鈥� including potential听losses in revenue听and the tougher-to-measure consumer trust. As such, some are already contemplating how to find听loopholes and other ways around听any new US听rules to build back doors, including by taking business overseas.

At a macro level, companies are concerned about the听global implications听if other countries seek their own channels to access customers鈥� data using the US policy as a precedent. How the most powerful government in the world decides to proceed on encryption will have a profound effect听not just on听development of consumer technologies听but the rights of Internet users in the future, they say.听And the encryption debate comes at a time when the US government and the American tech sector听need听each other more than ever as advanced computing听and digital security听become increasingly key for the听country鈥檚听economy and national defense.听The squabble over听encryption, however, may end up standing in the way 鈥� and the principles each side decides to fight for could set the tone for the future of the Surveillance Age.

Back doors not in the business plan

After the Snowden leaks began in June 2013, American businesses听learned that perceptions of insecurity can听hurt their听sales.

After听the听Snowden leaks,听major companies such as Apple and IBM spent billions of dollars building data centers overseas to combat the impression the US government would have unfettered access to foreign customers鈥� data. Many countries in Europe and elsewhere听pushed for laws requiring their citizens鈥� data to be stored locally as international trust in US products and services dipped.听Overseas听competitors 鈥� in some cases using what they claimed was 鈥淣SA-proof鈥� technology as a marketing scheme 鈥� swooped up suspicious customers, according to听听last year on the global听business impacts of the surveillance revelations. It also听detailed some听lost opportunities, such as when Brazil, for instance, awarded a major contract for fighter jets to Swedish company Saab over Boeing, the American company that had previously been the frontrunner. In the cloud computing space, Forrester Research听听US businesses听could lose as much as听$180 billion by 2016.

At the same time, security teams across the country prioritized defending听against a semi-omniscient 鈥淕lobal Passive Adversary鈥� 鈥� now code for the NSA 鈥� above other potential threats. Unlike a criminal exploiting WiFi at a Starbucks, for instance, the听US government could have a much wider aperture to monitor听communications, with agents tapping into听the Internet backbone,听lurking at听the data centers, and听armed with big data analytics tools to connect the dots.

One way communications companies could prove they would be able to protect customers鈥� data听was by building stronger encryption. Last year, Apple updated its privacy policy to reflect that under its new mobile operating system for the iPhone 6, personal data such as e-mail and messages would 鈥� automatically 鈥� be so strongly encoded the company would not even be able to access the key to unlock it.

Therefore, as Apple鈥檚 privacy terms clarified, 鈥渋t鈥檚 not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8.鈥� Google is implementing similar data encryption; Yahoo recently rolled out a new end-to-end encryption extension for Yahoo Mail.

The moves by some of the most influential US companies to set a new standard for security were hailed as milestones for consumer protection at a time when data breaches were proliferating and exposing reams of personal information from Social Security Numbers to credit cards 鈥� and as听a way to keep other countries with advanced cybersecurity capabilities from trying to undertake similar activities.

And companies will not be giving up the security high ground so easily, especially after the Snowden leaks put them in a difficult position.听

鈥淚t鈥檚 clear that other countries would just not accept American products that have a back door built into them for the US government,鈥� says Alex Stamos, former听chief information security officer for Yahoo who just started as Facebook鈥檚 chief security officer.听鈥淭here鈥檚 no way they鈥檙e going to be OK with that.鈥�

At this point, though, major companies are trying to project how much they would lose if such a听policy went into effect. 鈥淒o we lose 90 percent of our business in Germany? Or 20 percent? No idea,鈥� one senior official from a major multinational tech company said. Either way, says the official, who was not authorized to speak on the record, 鈥渢hat鈥檚 a big deal.鈥� Chinese telecommunications company Huawei has struggled, for instance, to win major projects in the US and around the world amid fears something is embedded within the hardware by the government there. US companies worry they could end up in a similar category of mistrusted, or totally shunned, products around the world.

听

It鈥檚 not just large companies that would feel the effects of such a policy. Take Vormetric, a relatively small but influential data security company that sells both encrypted hardware and software to protect high value data. Nearly 80 percent of its business is in the US, but its clients include 17 of the Fortune 30 companies 鈥� and many of them have an entrenched business presence overseas. 鈥淪o, if we are working with an insurance company that sells around the world, and it鈥檚 American-based, what鈥檚 going to happen to their business in Japan if this law gets passed, and they鈥檙e known to be using American-made technology?鈥� says Alan Kessler, Vormetric鈥檚 chief executive officer. 鈥淚t would negatively impact them 鈥� and us.鈥�

It would, however, leave the door open for international competitors to capture more of the market. 鈥淎bsolutely it鈥檚 an opportunity for us,鈥� says Trent Telford, chief executive officer of Australian-based data security company Covata, which has offices in Reston, Va.,听and London.听鈥淯ntil the American software companies duke it out with the US government, I think there鈥檒l continue to be more opportunity for us 鈥� . Because my code started offshore and remains offshore, I haven鈥檛 had to tackle the question.鈥�

Several US companies said they would听consider developing a separate version of their products just for American users if a mandatory back听door policy went into effect. That way, they could keep their international business. But this would come with a social cost. 鈥淭he companies would very likely say, 鈥楢lright, fine, Americans don鈥檛 have security, but everybody else in the world does,鈥� explains Jon Callas, chief technologist of the encrypted communications company Silent Circle. 鈥淪o now you have a situation where if you are in Saudi Arabia, you can get encryption 鈥� but you can鈥檛 in the United States.鈥�

Americans could also have a harder time buying security products based overseas. Silent Circle left the US for Switzerland听. But if a back听door law passed, says Mr. Callas, who cofounded the company with Phil Zimmerman, creator of the most widely used e-mail encryption software in the world, 鈥渨e would have no choice鈥� but to scrap the company鈥檚 North American business that makes up 20 percent of its sales.

That鈥檚 not an option for most major US tech companies. As Apple Chief Executive Officer Tim Cook maintains in the company鈥檚 privacy statement: 鈥淲e have never worked with any government agency from any country to create a back door in any of our products or services. We have also never allowed access to our servers. And we never will.鈥� Mr. Cook even told The New York Times the NSA 鈥渨ould have to cart us out in a box鈥� before that happens.

So some companies听are already pondering contingency plans for听how to entirely听avoid legal requirements that would require听back doors,听including by opening subsidiaries overseas 鈥� even though this venture on a mass scale, according to the senior tech official,听could cost听even more than听complying听or听creating a separate system for the US.听The senior听official,听whose company currently听operates in almost every country around the world,听said听American businesses would thus have to make hard decisions about which markets to serve and whether some would be worth the extra cost and effort. 鈥淚f we had to stand up 160 data centers鈥� in different countries to get around the US law, the official said, 鈥渢here鈥檚 a lot of countries we wouldn鈥檛 serve or it鈥檇 be too expensive.鈥�

American industry officials do not want to be diplomats听

The encryption debate turned Mr. Stamos听into a social media folk hero among techies, cryptographers, and privacy advocates. While representing听Yahoo听at a cybersecurity conference, he听publicly challenged NSA chief Admiral听Rogers on the global business implications of building back doors into encryption.听

Yahoo has 1.3 billion users around the world.听鈥淥nce we open the door an inch for the US government, there are a number of countries that want to kick that door open,鈥� Stamos told Passcode. 鈥淥nce you give up that high ground for the US, then it鈥檚 a matter of companies deciding which countries get what they want. Or don鈥檛.鈥�

The government鈥檚听push for access to secure data isn鈥檛 uniquely American. And the appetite for that kind of access is only increasing after Snowden exposed what the US government was doing in secret.听

China, for instance, has been pushing ahead with an antiterrorism proposal that would require tech firms to give encryption keys and install back doors to allow local law enforcement access for counterterrorism investigations. And, citing the Paris terror attacks on Charlie Hebdo magazine earlier this year, British Prime Minister David Cameron made it one of his campaign promises to ban encrypted online messaging apps such as WhatsApp 鈥� unless the government gets back door access. 鈥淲e can鈥檛 only use China as a boogeyman,鈥� Stamos said. 鈥淓ven allies and democracies might be asking for intentionally weakened products in the future. The best thing the US can do is say, 鈥楢merican companies build the most secure products for consumers, and that鈥檚 the right thing to do.鈥� 鈥�

President Obama came听out strongly against the Chinese proposal,听听it be changed before American companies would do business with that country, but did not publicly break with Prime Minister Cameron鈥檚 sentiments in public comments after two days of joint meetings in Washington earlier this year.

As听US president, choosing which countries to support in their demands for back doors is Obama鈥檚 prerogative. But officials at American companies say it鈥檚 鈥減arochial鈥� or 鈥渕yopic鈥� 鈥� or even 鈥渉ypocritical鈥� 鈥� for the government to put companies in a position, effectively, of sideline American diplomats.

鈥淚f we are going to make a technological system that will let [FBI Director] Comey catch the bad guy that he wants to catch 鈥� then we have to let the Chinese get those awful people with umbrellas who were assaulting police and blocking pepper spray,鈥� says Callas of Silent Circle. 鈥淲e have to let the Iranians get the green dissidents there. We have to let everybody who is a state actor clamp down and be able to get what they want.鈥� 听

And most US companies wouldn鈥檛 want to be in a position where users鈥� data, if they turn it over to other countries, could be used to prosecute 鈥� or potentially kill 鈥� them. 鈥淚 don鈥檛 want to have to be the person who is judge, jury and executioner,鈥� Callas says. 鈥淚f I hand it over, it鈥檚 [people鈥檚] secrets. You can鈥檛 pull it back.鈥澨�

What鈥檚 more, if it becomes the norm for dominant world powers to demand back door access, the future Internet may become even more politicized.听

听

Governments 鈥� the ones with enough markets to compel companies to serve them regardless of their restrictive policies 鈥� could have jurisdiction over users within their borders.听This balkanization could have a massive impact on the global economy. Products that currently are interoperable and work all over the world, could only work within certain countries that accept them.听

鈥淭he IT industry, including Cisco, has thrived on a model where we develop technology once and then sell it around the world,鈥� says Eric Wenger, director of cybersecurity and privacy policy at Cisco, the world鈥檚 largest maker of networking equipment. 鈥淲e urge the government to avoid adopting policies that would break, or threaten, that model. We have to make sure our customers have a strong degree of confidence in the things we build. That means we continually work to detect and defend against any threats to our products and services 鈥� regardless of their source.鈥�

Crypto Wars 2.0听

NSA director Rogers听floated a proposal听this year to create a 鈥渇ront door鈥� to access the data with multiple 鈥渂ig locks.鈥� Decrypting the data under this plan,听, would require merging multiple keys, created and stored away from the user, so that no one entity could access the protected information听alone. In this process, known as 鈥渟plit keys,鈥� it would take听both key holders 鈥� for instance, both the FBI and Apple 鈥� to听access the data with a court order.

But experts contend there鈥檚 no such thing as secure听encryption with a听channel for an outside party听to access. Under any circumstances. 鈥淭here鈥檚 no VIP room; it doesn鈥檛 exist,鈥� Intel鈥檚 Montgomery says. 鈥淚f there鈥檚 a back door, there鈥檚 a back door for everybody.鈥�

It reminds security pros of the 1990s 鈥渃rypto wars,鈥� when the Clinton administration听听a similar idea, to keep a master key for the government or a trusted third party to decrypt voice communications. But it didn鈥檛 take long for Matt Blaze, currently a computer science professor at the University of Pennsylvania, to听听fundamental weaknesses in the so-called 鈥淐lipper Chip鈥� designed by the NSA听when he was working at AT&T Bell Laboratories. The government backed down.

But two decades later, Callas says there鈥檚 still no way to implement this kind of split-key system. 鈥淚f we had a way to do a two-key system, we would be able to sell that to corporations so their data could be unlocked,鈥� he said. 鈥淧eople would buy that.鈥�

What鈥檚 more, as industry officials point out, encryption technology is not built by superheroes. It鈥檚 built by people in cubicles. 鈥淪omebody has to write the code to support that,鈥� says Chris Eng of Veracode, a cybersecurity firm. 鈥淎 split key is obviously better than one shared key in a safe somewhere. But each layer is going to increase the complexity. The more complex it is, the better chance somebody鈥檚 going to mess up. It鈥檚 going to be something you can exploit.鈥澨�

And, Mr. Eng says, trying to听crack听that system would be听a challenge eagerly听accepted by听every adversarial nation. 鈥淚t鈥檚 going to be, all of the sudden, the most valuable system in the world. So you鈥檙e going to have nation-states with pretty much unlimited budgets trying to break that system,鈥澨齢e said. And if they break it, they would gain听access to a听treasure trove of the most intimate details of听people鈥檚 personal lives, from, say, their conversations with loved ones,听online听political organizing, e-mailed听business plans, and听financial information.

From cryptographer confabs to Congress听

In recent weeks, the encryption debate has expanded beyond the听halls of tech听conventions such as the听RSA Conference. Congressional hearings and social media debates have helped form a coalition of tech companies,听civil society groups, and technologists听听against the push for back doors. 听听

Still, the most ardent proponents for government access to encryption, such as FBI Director Comey, are undeterred.

鈥淚 think these folks don鈥檛 see what I see or they鈥檙e not fair-minded,鈥� he said of the tech industry鈥檚 backlash. 鈥淓ither one of those things is depressing.鈥�

Comey projects that Apple and Google鈥檚 move toward stronger encryption will only become more pervasive in an interconnected society. Recent default encryption settings, and encrypted devices and networks, Comey has said, mean the country鈥檚 protectors are 鈥済oing dark鈥� in their pursuit of predators, violent criminals, terrorist cells using social media to recruit, plan and execute attacks.听

听Since the companies, even under subpoena,听would not even听be able to unlock听the original听customer听data protected by the strong听encryption such as听photos, documents, e-mails and recordings on the device they would be ordered to turn over, law enforcement and intelligence officials fear they could miss potentially valuable leads and evidence that听could help catch and prosecute criminals and terrorists. And he says that听cracking today鈥檚 high-level encryption would be nearly impossible听even with supercomputers.听鈥淎ll of our lives will be covered by strong encryption,鈥� Comey told a Washington audience in late May. 鈥淭herefore all of our lives 鈥� including the lives of criminals and terrorists and spies, will be in a place that is utterly unavailable to court-ordered process. And that, to a democracy, should be utterly concerning.鈥�

Many tech executives say they sympathize with law enforcement鈥檚 plight. They realize听it鈥檚 much harder for them to access the communications they want because of the stronger technologies they created.听

But they also听suspect that听if the US government wins the increasingly听public听debate over back doors, it won鈥檛 just drive innocent听customers overseas;听the craftiest criminals and听terrorists US officials are likely听trying to catch听would听have plenty of other ways to communicate besides听the products听they know听have back doors for the听government. They, too, could use听encryption on devices听from other countries that don鈥檛 require those standards.听鈥淚f I鈥檓 a terrorist,听I鈥檒l听stop using American products,鈥� says听Tsion Gonen, a听vice president听at digital security company听Gemalto, which is headquartered in Amsterdam. 鈥淚鈥檓听not sure I听understand [why the US would announce] 鈥楨veryone, we have a backdoor! Please consider using this for your terrorist attack.鈥� 鈥�

What鈥檚 more, says Daniel Ford, chief security officer at Silent Circle, 鈥淚t鈥檚 not up to us to make it easy for the government to do the investigation.听It鈥檚 up to them to provide the burden of proof 鈥� and develop talent to get into these systems.鈥� Otherwise, he says, the US听should use other investigative techniques to get the information it needs. After all, cracking听鈥渆ncryption听is just one way to go after somebody,鈥� Mr. Ford says. 鈥淭o build in a back door is just an easy button.鈥澨�

It seems that Congress may agree with that sentiment, too.听In a sign of political will 鈥� and, perhaps, a sign they are already hearing American industry鈥檚 concerns 鈥� the Republican-controlled House of Representatives passed an amendment听to a major appropriations bill in June seeking to stop the government from forcing tech companies to build back doors or otherwise听alter听their products to allow for more electronic surveillance.听

It passed 255-174.听

听