🔴 Should We Also Hand Over a Spare Set of Keys to Our Apartments?

Article 8ter of the Narcotrafic bill (the drug-trafficking law) aims to force encrypted services to provide access to law enforcement, and it is back before the National Assembly.

• The government is defending a new approach that rules out “backdoors,” but cybersecurity experts denounce a weakening of encryption.
• The head of the DGSI (domestic intelligence) herself insists on a vital need for access to conversations on national security grounds, but struggles to offer a technical argument.
• The small group of lawmakers who specialize in digital issues criticizes a measure that is ineffective and dangerous, and would create exploitable vulnerabilities.
• Guillaume Poupard, former head of ANSSI (France's national cybersecurity agency) and a heavyweight in cryptography in his own right, denounces this approach:

The question of whether or not these are backdoors🚪 is sterile. Modifying security functions covertly in order to defeat their very purpose is introducing a backdoor. Period.Is this method less dangerous than weakening encryption mechanisms🔐 or escrowing keys🔑? No doubt about it. But less stupid than utterly moronic is not necessarily a synonym for intelligent...

• Signal has already announced it will pull out if the law is passed.
• The Telegram example, cited as justification, is considered beside the point, since its encryption is not enabled by default.

The debate raises deep concerns about digital sovereignty and security in France, and reveals a governance problem.

We need a cyber minister, and an ANSSI placed directly under the authority of the prime minister. When you are not in the conversation, in the meeting or at the cabinet table, there is no way of knowing whether the person supposed to defend these issues will do so with the same commitment, the same precision and the same conviction.

The relationship between technology and politics is above all a matter of experience. Many ministers think they can navigate by intuition. That may work in some fields, but certainly not in digital, where real expertise and access to technical knowledge are indispensable.

This is even more true in the world of cybersecurity, where experience is forged through crises averted (or not) and governance problems overcome (or not). It is not a field where posturing will do.

It is essential to keep saying so, because history keeps repeating itself.

Take encryption: I remember meeting John Perry Barlow and the members of the EFF at the time of the debate over the Clipper chip, that famous “Clipper Chip” the NSA wanted to impose in every electronic communication tool.

The Short Life and Humiliating Death of the Clipper Chip

Thirty years ago, the U.S. government first floated the idea of a backdoor into public-key encryption, an idea it’s been obsessed with ever since.

GizmodoLucas Ropek

I remember that back then, encryption was illegal in France for years, while the United States had already enshrined it. It took time before it was finally recognized as a fundamental right to privacy.

France has just authorized the securing of telephone and electronic communications. At last, the right not to be listened to.

LibérationOlivier Debouzy

The question of weakening it keeps coming back. We already lived through it with the “black boxes” of the intelligence law, on which the Conseil national du numérique (the National Digital Council), unlike for other bills, had not been consulted. I insisted at the time that we publish a statement on the subject, going so far as to put my resignation as vice-president on the line.

But it has to be said again, forcefully: today, weakening digital security is sheer madness.

In the current geopolitical context, it would be like requiring everyone to hand the government a spare set of keys to their apartment.

Can you imagine handing a spare set of your house keys to the Interior Ministry?

Continued for members