When does safe and productive use of cryptography cross over to cryptophilia?

Encryption makes the Internet possible, but there are some controversial and other downright stupid uses for which we all pay.

Imagine someone creating or supporting a technology that consumes vast amounts of energy only to produce nothing of intrinsic value and being proud of that of that fact. Such is the mentality of Bitcoin supporters. As the Financial Times reported several days ago, Bitcoin mining, the process by which this electronic fools’ gold is “discovered”, takes up as much power as a small country. And for what?

Cambridge University Bitcoin Electricity Consumption Index shows that bitcoin mining consumes more energy than entire countries — *Cambridge University Bitcoin Electricity Consumption Index*

The euro, yen, and dollar are all tied to the fortunes and monetary policies of societies as represented by various governments. Those currencies are all governed by rules of their societies. Bitcoin is an attempt to strip away those controls. Some simply see cryptocurrencies as a means to disrupt the existing banking system, in order to nab a bit of the financial sector’s revenue. If so, right now they’re not succeeding.

In fact nothing about cryptocurrency is succeeding, while people waste a tremendous amount of resources. Bitcoin has been an empty speculative commodity and a vehicle for criminals to receive ransoms and other fees, as happened recently when the Colonial Pipeline paid a massive $4.4 million to DarkSide, a gang of cyber criminals.

What makes this currency attractive to hackers is that otherwise intelligent people purchase and promote the pseudo-currency. Elon Musk’s abrupt entrance and exit (that some might call Pump and Dump), demonstrates how fleeting that value may be.

Bitcoin is nothing more than an expression of what some would call crypto-governance, a belief that somehow technology is above it all and somehow is its own intrinsic benefit to some vague society. I call it cryptophilia: an unnatural and irrational love of all things cryptography, in an attempt to defend against some government, somewhere.

Cryptography As a Societal Benefit

Let’s be clear: Without encryption there could be no Internet. That’s because it would simply be too easy for criminals to steal information. And as is discussed below, we have no shortage of criminals. Today, thanks to efforts by people like letencrypt.org, the majority of traffic on the Internet is encrypted, and by and large this is a good thing.

This journey took decades, and it is by no means complete.

Some see encryption as a means by those in societies who lack basic freedoms as a means to express themselves. The argument goes that in free societies, governments are not meant to police our speech or our associations, and so they should have no problem with the fact that we choose to do so out of their ear shot, the implication being that governments themselves are the greatest threat to people.

Distilling Harm and Benefit

Bitcoin is an egregious example of how this can go very wrong. A more complicated case to study is the Tor network, which obscures endpoints through a mechanism known as onion routing. The proponents of Tor claim that it protects privacy and enables human rights. Critics find that Tor is used for illicit activity. Both may be right.

Back in 2016, Matthew Prince, the CEO of Cloudflare reported that, “Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious.” He went on to highly that a large portion of spam originated in some way from the Tor network.

One recent study by Eric Jardine and colleagues has shown that some 6.7% of all ToR requests are likely malicious activity. The study also asserts that so-called “free” countries are bearing the brunt of the cost of Tor, both in terms of infrastructure and crime. The Center for Strategic Studies quantifies the cost at $945 billion, annually, with the losses having accelerated by 50% over two years. The Tor network is key enabling technology for the criminals who are driving those costs, as the Colonial Pipeline attack so dramatically demonstrated.

Visualization of TOR network, showing packets flowing largely between Europe and the US. — Torflow visualization of the Tor network (2016)

Each dot on the diagram above demonstrates a waste of resources, as packets make traversals to mask their source. Each packet may be routed and rerouted numerous times. What’s interesting to note is how dark Asia, Africa, and South America were.

Wall Street dark web market arrests in Europe and the US

While things have improved somewhat since 2016, bandwidth in many of these regions still comes at a premium. This is consistent with Jardine’s study. Miscreants such as DarkSide are in those dots, but so too are those who are seeking anonymity for what you might think are legitimate reasons.

One might think that individuals have not been prosecuted for using encrypted technologies, but governments have been successful in infiltrating some parts of the so-called dark web. A recent takedown of a child porn ring followed a large drug bust last year by breaking into Tor network sites is enlightening. First, one wonders how many other criminal enterprises haven’t been discovered. As important, if governments we like can do this, so can others. The European Commission recently funded several rounds of research into distributed trust models. Governance was barely a topic.

Other Forms of Cryptophilia: Oblivious HTTP

A new proposal known as Oblivious HTTP has appeared at the IETF that would have proxies forward encrypted requests to web servers, with the idea of obscuring traceable information about the requestor.

The flow diagram for Obvlivious HTTP shows a client talking through a proxy to a request resource to the target resource. — Oblivious HTTP, from draft-thomson-http-oblivious-01

This will work with simple requests a’la DNS over HTTP, but as the authors note, there are several challenges. The first is that HTTP header information, which would be lost as part of this transaction, actually facilitates the smooth use o the web. This is particularly true with those evil cookies about which we hear so much. Thus any sort of session information would have to be re-created in the encrypted web content, or worse, in the URL itself.

Next, there is a key discovery problem: if one is encrypting end-to-end, one needs to have the correct key for the other end. If one allows for the possibility of receiving such information using non-oblivious methods to the desired web site, then it is possible to obscure the traffic in the future. But then an interloper may know at least that the site was visited once.

The other challenge is that there is no point of obscuring the information if the proxy itself cannot be trusted, and it doesn’t run for free: someone has to pay its bills. This brings us back to Jardine, and who is paying for all of this.

Does encryption actually improve freedom?

Perhaps the best measure of whether encryption has improved freedoms can be found in the place with the biggest barrier to those freedoms on the Internet: China. China is one of the least free countries in the world, according to Freedom House.

Snapshot from Freedom House shows China toward the bottom in terms of Freedoms — From Freedom House

Another view of the same information comes from Global Partners Digital:

Much of Asia has substantial restrictions on encryption. — Freedom to use encryption: not all countries are assessed.

Paradoxically, one might answer the question that freedom and encryption seem to go hand in glove, at least to a certain point. However, the causal effects seem to indicate that encryption is an outgrowth of freedom, and not the other way around. China blocks the use of Tor, as it does many sites through its Great Firewall, and there has been no lasting documented example that demonstrates that tools such as Tor have had a lasting positive impact.

On the other hand, to demonstrate how complex the situation is, and why Jardine’s (and everyone else’s) work is so speculative, it’s not like dissidents and marginalized people are going to stand up for a survey, and say, “Yes, here I am, and I’m subverting my own government’s policies.”

Oppression as a Service (OaaS)

Cryptophiliacs believe that they can ultimately beat out, or at least stay ahead of the authorities, whereas China has shown its great firewall to be fully capable of adapting to new technologies over time. China and others might also employ another tactic: persisting meta-information for long periods of time, until flaws in privacy-enhancing technology can be found.

This gives rise to a nefarious opportunity: Oppression as a Service. Just as good companies will often test out new technology in their own environments, and then sell it to others, so too could a country with a lot of experience at blocking or monitoring traffic. The price they charge might well depend on their aims. If profit is pure motive, some countries might balk at the price. But if ideology is the aim, common interest could be found.

For China, this could be a mere extension of its Belt and Road initiative. Cryptography does not stop oppression. But it may – paradoxically – stop some communication, as our current several Internets continue to fragment into the multiple Internets that former Google CEO Eric Schmidt raised in 2018 thought he was predicting (he was really observing).

Could the individual seeking to have a private conversation with a relative or partner fly under the radar of all of this state mechanism? Perhaps for now. VPN services for visitors to China thrive; but those same services are generally not available to Chinese residents, and the risks of being caught using them may far outweigh the benefits.

Re-establishing Trust: A Government Role?

In the meantime, cyber-losses continue to mount. Like any other technology, the genie is out of the bottle with encryption. But should services that make use of it be encouraged? When does its measurable utility become more a fetish?

By relying on cryptography we may be letting ourselves and others off the hook for their poor behavior. When a technical approach to enable free speech and privacy exists, who says to a miscreant country, “Don’t abuse your citizens”? At what point do we say that, regardless, and at what point do democracies not only take responsibility for their own governments’ bad behavior, but also press totalitarian regimes to protect their citizens?

The answer may lie in the trust models that underpin cryptography. It is not enough to encrypt traffic. If you do so, but don’t know who you are dealing with on the other end, all you have done is limited your exposure to that other end. But trusting that other end requires common norms to be set and enforced. Will you buy your medicines from just anyone? And if you do and they turn out to be poisons, what is your redress? You have none if you cannot establish rules of the Internet road. In other words, governance.

Maybe It’s On Us

Absent the sort of very intrusive government regulation that China imposes, the one argument that cryptophiliacs have in their pocket that may be difficult for anyone to surmount is the idea that, with the right tools, the individual gets to decide this issue, and not any form of collective. That’s no form of governance. At that point we had better all be cryptophiliacs.

We as individuals have a responsibility to decide the impact of our decisions. If buying a bitcoin is going to encourage more waste and prop up criminals, maybe we had best not. That’s the easy call. The hard call is how we support human rights while at the same time being able to stop attacks on our infrastructure, where people can die as a result, but for different reasons.

Editorial note: I had initially misspelled cryptophilia. Thanks to Elizabeth Zwicky for pointing out this mistake.

Arlington National Cemetery: for those who served, and remained true

Those who attempted insurrection must never be laid to rest at Arlington.

There is a price for freedom and there is a price for dishonor. The history of Arlington National Cemetery reflects both. The land had great appeal to the Quartermaster General of the Union Army, General Montgomery Meigs, because Robert E. Lee’s home rested on it, and he despised Lee for having taken up arms against the Union. The land was unceremoniously wrested from the Lee family in an undermarket tax sale in January of 1864.

The first soldier laid to rest there was twenty one year old Private William Christman, of the 67th Pennsylvania Infantry, on May 13, 1864, but he and others were not initially interred near Lee’s house. Such burials happened only later, at Meig’s explicit instructions, so that Lee could not ever return to the estate without seeing the damage he and the rebels had caused. Meigs’ hatred of rebels only intensified with the death of his son John in October, that same year.

Born of such resentment Arlington Cemetery is now the pinnacle of the national cemetery system of the United States, an honor we pay those who have sacrificed, where generals and privates alike share some space.

Congress has denied burial at Arlington to murderers and certain others. They should also strip that privilege from anyone who was part of this year’s attempted insurrection. To allow burial of such people there would be to desecrate the memory of the sacrifice of those who dedicated their lives to our freedoms, many of who gave what Lincoln called the last full measure of their devotion to the Union.

That Bench

Before the pandemic, Saturday was The Big Day in our town. It was the day when people shopped, and it was the day when people socialized. It would be when the Pfadi (the Girl+Boy Scouts) would do their hikes and play their games, and it was where the new and old would meet. And many would do so in the shopping center in the center of town.

A fixture within the shopping center in the center of our town is this bench. I would call it the old Italian bench, because old men would meet there and converse… animatedly… in Italian. And no, if you weren’t old, and didn’t speak Italian, you would certainly not be invited to join in, and you would be frowned upon for sitting on that bench on a Saturday morning. It was their bench at that time, and everyone in town knew it. And why not? It was a pleasure to see them enjoying each other’s company.

That bench has been empty for over a year.

One of the things I missed in California was a sense of community. It has been something that I have treasured in my little town. It is not something that Zoom, WebEx, Meetecho, FaceTime, or Skype can replace, nor is it something that Facebook, Twitter, Pinterest, or WhatsApp can replace. The human contact, not just of friends and family, but of community has been missing.

As we get beyond the pandemic, I hope that bench fills soon, that the animated Italian conversations return, and that families can also meet at that shopping center and let their children play either indoors or out while they have a cup of coffee or a meal together, as we did. I hope we can regain our community.

Enabling the Crazy: Republicans and the right wing need to be held accountable for their dishonesty

Until Republicans police their own and use honest arguments, they cannot be trusted.

Over the last forty years, Republicans have developed some very bad habits. False equivalencies, out and out lying (such as claiming that Saddam had weapons of mass destruction), hypocritical stances (such as denying Merrick Garland a hearing for a position on the Supreme Court), accepting of lies for political expediency, and accusing the opposition of the very sins they commit are only some of the tactics that Republican base has grown to accept through networks such as Fox News and numerous zany online hysteria sites.

After a Berkman study found study (among many others) demonstrated that right wing media does not hold itself to account, and that Facebook is far more right wing than Twitter, Facebook began to take steps to address false reports. This led to criticism of social networks by President Trump, and a business opportunity for other purveyors of falsehoods. That is because Republicans can no longer survive without the falsehoods. A few people have noticed this danger, one of them being the founder of the founding online editor of the Washington Examiner and NewsBusters, Matthew Sheffield. In his own words:

I eventually realized that most people who run right-dominated media outlets see it as their DUTY to be unfair and to favor Republicans because doing so would some how counteract perceived liberal bias.
While I was enmeshed in the conservative media tradition, I viewed lefty media thinkers like @jayrosen_nyu as arguing that journalism was supposed to be liberally biased. I was wrong. I realized later that I didn’t understand that journalism is supposed to portray reality.

Mr. Sheffield wasn’t the only one to notice this problem. Last week Charles Koch put it quite simply: “Boy, did we screw up!” He did so by funding the Tea Party that fed on propaganda, not journalism.

The news echo chamber in which right wing people live live is not a threat to democracy, but is a threat to good, sound government, and to the health and welfare of the public. Donald Trump’s lies about the Corona Virus are merely the logical conclusion of a concerted attack that began with Rush Limbaugh in the 1980s, intensified with Fox News, and has led to such hate sites as InfoWars. Although Senator McConnell is smart enough not to peddle conspiracies, he has no problem profiting from them. He therefore does nothing to correct them, putting party before country. And so what do we get? Failure to recognize the risks of climate change, improper preparation for what became a pandemic that has led to economic destruction and chaos, and breeding of bigotry and violence.

Moral equivalences to justify some of Donald Trump’s more egregious acts seem to be a favorite. Previously we heard how, because cages were built under the Obama administration to house children for periods of up to 72 hours when they had no other place to go, it was therefore okay for the Trump administration to target migrant families for separation.

The latest claim from my friends on the right, led by people such as Representative Steve Scalise, has been that Donald Trump has the same right to use the courts to make whatever challenges he will, just as Al Gore did when he lost to George Bush in 2001. It is true that Al Gore did use the courts to attempt require a recount in certain districts. In that case, Gore and his legal team made very specific claims, and had evidence to advance them. They were these:

(1) The rejection of 215 net votes for Gore identified in a manual count by the Palm Beach Canvassing Board as reflecting the clear intent of the voters;
(2) The rejection of 168 net votes for Gore, identified in the partial recount by the Miami-Dade County Canvassing Board.
(3) The receipt and certification after Thanksgiving of the election night returns from Nassau County, instead of the statutorily mandated machine recount tabulation, in violation of section 102.14, Florida Statutes, resulting in an additional 51 net votes for Bush.
(4) The rejection of an additional 3300 votes in Palm Beach County, most of which Democrat observers identified as votes for Gore but which were not included in the Canvassing Board’s certified results; and
(5) The refusal to review approximately 9000 Miami-Dade ballots, which the counting machine registered as non-votes and which have never been manually reviewed.
Gore v. Harris, Florida Supreme Court, SC00-2431, December, 2000.

Each of these claims were specific, backed up by facts that were not in dispute, and raised substantial questions of procedure, as demonstrated by the ruling of the Florida Supreme Court. The point here is not to re-litigate an election that took place 20 years ago, but rather to highlight how Mr. Gore used the courts in good faith, even if he lost in the end.

In this case, the Trump campaign has put forward wild claims that have not been backed by evidence or law. While President Trump and his cronies have whined about fraud to the press and to the American people, when they have gone to court, their tune has been very different.

In Pennsylvania, Arizona, Michigan, and Nevada, when asked if they were arguing that fraud had occurred, the answer was “No”. In Michigan or Wisconsin, where the best they could come up with were what they called statistical irregularities. In 2016, those same “irregularities” occurred in districts Trump won, and yet there was no complaint at the time. That’s because there was no actual evidence or testimony of any wrong doing. Mr. Trump is a sore loser. He has thrown spaghetti at a wall to see what would stick. He and his clown, Rudolph Giuliani, have wasted the time of the courts, and have attempted to undermine the very institutions he swore to uphold. In computing we would call this a Denial of Service (DoS) attack, in which the resources of courts and opponents are wasted by suits filed in bad faith. In Williamsport, Pennsylvania, US District Judge Matthew W. Brann, a lifelong Republican, castigated Mr. Giuliani for his buffoonish arguments, writing:

… this Court has been presented with strained legal arguments without merit and speculative accusations, unpled in the operative complaint and unsupported by evidence.

In Georgia, Trump and his fellow loons have attacked the Republican Secretary of State for having followed the law and performed his duties. One of his loons, Russell J. Ramsland Jr., filed an affidavit that raised concerns about alleged incidents that didn’t even take place in the state. They have attacked various government officials in Nevada as well.

In the meantime, Republican senators and governors largely sat silent, allowing this travesty to continue. With one exception, the only people who dared to stand up to Mr. Trump were those who were retiring, or those who had just been reelected. That required no courage or leadership whatsoever. These people have been swayed by Trump’s media madness, worrying that they might not get re-elected, or thinking they might develop a political advantage when Biden is sworn in. Winning, not their oaths to their country, is all that matters to them.

Some will say that Democrats are no better, that Democrats obstructed Mr. Trump from the moment he came into office. Maybe there is some truth to this, but at least in the Democrat’s case, they used legal means and the stark truth to support their positions. Not so with the Right Republicans in Congress, and enablers such as Senator Collins.

There can be no reconciliation, nor can their be trust in their role in government, until Republicans police their own, starting with taking responsibility for not having stood up to a liar and bully, who harmed a great many people.

I have hope and gratitude, thanks to medical research and the Internet.

I am grateful to medical researchers, those on the front line, and those who are keeping us from going crazy in our homes.

I write this to you today from my house, and you probably read this note from your house or apartment. Our lives are disrupted. We cannot go to the movies or restaurants, we cannot get our hair cut, we cannot go to weddings or baby showers, and many of us cannot go to our offices or to visit our customers or partners. We cannot go to conferences, and our kids cannot go to schools.

We are doing all of this for fear that we or people we love will die of this awful illness. We are reading horror stories from Italy of their healthcare system being overwhelmed. As I write this to you I worry that the same thing will happen in Switzerland and elsewhere. I worry for my family.

This disease spread so quickly across the planet because of the ability of humanity to scale its transportation systems to efficiently move anyone from anywhere to anywhere, whether that’s by train, plain, ship, or automobile. This was largely not the case during the Spanish Flu of 1917. We need to practice “social distancing” even more so now than then, because the world is a lot smaller and more social place than it was, thanks to all of this capability.

That same human desire to innovate is what is going to save us now. It started early on in the medical community, who have been our first responders in this crisis. They have worked to identify the genetic sequence of the virus itself, to understand its transmission vectors, and to provide the world with initial advice on how to cope with this threat. Even as early as January, researchers across the globe were attempting to develop a vaccine. In the last few days, researchers have reported four types of immunity response cells to look for as people begin to recover. There are two studies that detail how Malaria medication may both improve recoveries and reduce the virus’ infectiousness.

By dint of necessity, we are virtualizing a great many of our activities. We are all learning how to use WebEx Teams or Microsoft Teams or Zoom or Google Hangouts. We are using FaceTime and other remote collaboration tools like never before. One of my friends is planning to virtualize his Passover Seder, and asked for advice on how to do this with Webex. He dubbed this SederEx. We are planning a virtual baby shower with a cousin. I have encouraged my old Kabuki-West crowd to have a virtual Wednesday night dinner together.

The first uses of the Internet were envisioned by its funders to have been military. That’s why the Advanced Research Project Agency (ARPA) funded the activity. It was clear from those early days and even before then that electronic communication would continue to reshape how we socialize in the world.

That’s because remote communication didn’t start with the Internet. The invention of the telephone let us “reach out and touch someone”. And that worked great for one-on-one communications. EMail gave us the ability to communicate in near real time with those around us. Instant messaging meant that people could hold several disconnected real time text conversations at once.

Today, however, we can all see each other, present to each other for work, not only hear but also see people’s reactions. In the face of this plague, people are having virtual baby showers, virtual drinks, and even virtual Passover Seders. You have to provide the non-virtual parts yourself, of course, but we are able to still be together, even when circumstances dictate that we be apart.

For those of us who have family who are a great distance away, this also represents a rare opportunity to participate in these sorts of events on an equal footing, without having the phone passed around for brief moments, simply to say hello. We are all in the same boat, this time.

The Internet is helping us remain social, as is in our nature to be. Social networks, which in the last few years could not be spoken of in public without some sort of derision, are a big part of the solution. When all of this is over, we will still need to sift through all of the negativity and nastiness that they engender, but let us give them their due as they help us stay connected to one another, as I am connecting to you today.

While we are not indebted in the same way to Internet engineers as we are to medical first responders and those who have to work through this crisis, like grocery store cashiers and police officers, let us also give Internet engineers a pat on the back for helping people self-isolate physically, without having to self-isolate socially.

And by the way, those medical research results I mentioned earlier are being shared by researchers with other researchers in a very timely fashion thanks to the Internet.