The limits of encryption

As we say goodbye to privacy, some people are putting their faith in encryption. But there’s only so much that encryption can do.

I’m not arguing that encryption is weak and in danger of being busted wide open. I’m not even arguing that companies such as Apple will reverse their stances and give up encryption keys to law enforcement.

I’m simply observing that not everything can be encrypted, and the things that can’t be encrypted can reveal plenty about us. And even Apple has no problem giving law enforcement that kind of information.

None of this is a secret, but it was underscored by an interesting email from an Apple executive that was included In batch of Clinton campaign emails that was released by WikiLeaks on Wednesday (Oct. 26).

The intercepted email was sent on Dec. 20, 2015, from Lisa Jackson, Apple’s vice president of Environment, Policy and Social Initiatives (who reports directly to CEO Tim Cook), to Clinton campaign Chairman John Podesta. Podesta and Jackson once shared the same employer, when Podesta worked at the White House and Jackson was the administrator of the U.S. Environmental Protection Agency.

Jackson wrote that Apple works “closely with authorities to comply with legal requests for data that have helped solve complex crimes. Thousands of times every month, we give governments information about Apple customers and devices, in response to warrants and other forms of legal process. We have a team that responds to those requests 24 hours a day. Strong encryption does not eliminate Apple’s ability to give law enforcement meta-data or any of a number of other very useful categories of data.”

It’s a simple point that many people haven’t grasped. Encryption can protect the contents of an email message, but it can’t hide who sent the message and who received it. That can be valuable information. Say that law enforcement officials are interested in a particular encrypted email that a suspect sent. If it can learn from the suspect’s carrier who the recipient was, it might be able to seize that person’s phone and read the message free of encryption. No muss and no fuss.

As for meta-data, it can show times, dates and even location. So, despite Apple proudly declaring that it protects its customers’ data no matter what, it is still giving the government a lot of information “thousands of times every month.”

Add in self-leaking mobile apps — due to inadequate app testing, as Amazon just discovered — and you see how hard it has become to keep much of anything private. We are getting to the point where the only way to keep information secret is to hide it from our phones. Maybe we’ll all have to become like Jason Bourne or the characters on Breaking Bad, buying disposable phones, using them once and then ditching them.

Sure, you’re not a meth dealer, so it’s not a problem, right? But let’s say that you plan to take a trip to secretly meet with a major competitor about a job. Do you really want to take along your company-issued smartphone and let it collect unencryptable geolocation datapoints as you go? Or use that phone to email the competitor? You can’t encrypt the email’s destination, so by the time you send four or five emails to the rival’s domain, you may find yourself in an awkward conversation with your boss.

Yes, strong encryption, enterprise-grade VPNs and dark web-friendly browsers such as Tor can enhance privacy, but they don’t even come close to shielding all sensitive data from prying eyes.

If you’ll excuse me now, I have some Dixie Cups and string to assemble.