WEBVTT Kind: captions Language: en 1 00:00:00.060 --> 00:00:03.400 There’s been a lot of talk about whether the British government will force 2 00:00:03.400 --> 00:00:07.340 companies like WhatsApp to introduce a backdoor into their encryption, 3 00:00:07.340 --> 00:00:10.960 so that the police and government can read your messages if they need to. 4 00:00:10.960 --> 00:00:13.820 As I record this, they haven't done it yet, 5 00:00:13.820 --> 00:00:18.170 but the laws that could let them do so in the future are already in place. 6 00:00:18.170 --> 00:00:21.560 And here's something you might not expect me to say: 7 00:00:21.560 --> 00:00:23.540 that sounds like a reasonable idea. 8 00:00:27.000 --> 00:00:30.650 After all, backdoors have been allowed for old-school phone conversations for decades. 9 00:00:30.650 --> 00:00:31.650 They’re called wiretaps. 10 00:00:31.650 --> 00:00:36.239 And if a criminal investigation has enough evidence that they can get a legal warrant, 11 00:00:36.239 --> 00:00:38.260 then they can look inside your postal mail, 12 00:00:38.260 --> 00:00:39.610 they can listen to your phone calls, 13 00:00:39.610 --> 00:00:41.260 and they can intercept your text messages. 14 00:00:41.260 --> 00:00:43.620 And it's called a wiretap because, many years ago, 15 00:00:43.620 --> 00:00:48.280 the police would literally be attaching a device to a physical phone wire. 16 00:00:48.280 --> 00:00:50.020 So for anyone who grew up knowing that, 17 00:00:50.020 --> 00:00:51.649 anyone who grew up with computers like this, 18 00:00:51.649 --> 00:00:54.129 like pretty much every politician in government, 19 00:00:54.129 --> 00:00:58.850 well, it seems reasonable that that should also extend to, for example, WhatsApp. 20 00:00:58.850 --> 00:01:00.480 So why not? 21 00:01:00.480 --> 00:01:03.239 Well, first, let's look at the technical detail. 22 00:01:03.239 --> 00:01:06.590 It all depends on who is holding the keys. 23 00:01:06.590 --> 00:01:08.220 Modern encryption uses complicated math 24 00:01:08.220 --> 00:01:10.960 that is easy for a computer to calculate one way, 25 00:01:10.960 --> 00:01:13.270 but almost impossible to work out in reverse. 26 00:01:13.270 --> 00:01:14.430 A really simple example: 27 00:01:14.430 --> 00:01:18.689 if I ask you to multiply two prime numbers together, like 13×17, 28 00:01:18.689 --> 00:01:21.490 you can do that by just hitting a few keys on your calculator. 29 00:01:21.490 --> 00:01:23.220 And because those were prime numbers, 30 00:01:23.220 --> 00:01:28.340 we know that's the only way to make 221 by multiplying two whole numbers together. 31 00:01:28.340 --> 00:01:31.860 Other than 221 times 1, and that's not really helpful. 32 00:01:31.860 --> 00:01:36.470 But if I ask you: what two prime numbers were multiplied together to make 161? 33 00:01:36.470 --> 00:01:38.160 There is no way to work that out quickly. 34 00:01:38.160 --> 00:01:40.079 There are a few shortcuts that you can take, 35 00:01:40.079 --> 00:01:43.079 but it's still basically a brute-force method. 36 00:01:43.079 --> 00:01:45.500 Now imagine that you're not trying to work out 161, 37 00:01:45.500 --> 00:01:48.250 but instead something like this... 38 00:01:48.250 --> 00:01:50.070 and you start to see the scale of the problem. 39 00:01:50.070 --> 00:01:51.900 And that's just a simple example, 40 00:01:51.900 --> 00:01:55.600 modern cryptography uses way more complicated one-way operations. 41 00:01:55.600 --> 00:02:00.340 The important part is that you can have a computer do math that’s simple one way, 42 00:02:00.340 --> 00:02:05.030 but could take longer than the lifetime of the universe to brute-force back. 43 00:02:05.030 --> 00:02:08.110 The result is that you can have two keys: two massive numbers. 44 00:02:08.110 --> 00:02:09.410 One public, one private. 45 00:02:09.410 --> 00:02:12.090 You send your public key out to the world. 46 00:02:12.090 --> 00:02:13.810 Anyone can encrypt a message with it: 47 00:02:13.810 --> 00:02:16.670 the message gets converted to what looks like random noise. 48 00:02:16.670 --> 00:02:19.850 Even that same public key can’t convert it back. 49 00:02:19.850 --> 00:02:22.020 But you can take that noise and use your private key 50 00:02:22.020 --> 00:02:23.920 -- and only your private key -- 51 00:02:23.920 --> 00:02:24.920 and they use their private key to decrypt it. 52 00:02:24.920 --> 00:02:27.620 When you want to send a message back, you use their public key, 53 00:02:29.560 --> 00:02:34.760 And the beautiful part of this: there's no need to exchange keys in advance, 54 00:02:34.760 --> 00:02:38.230 you don't have to work out old-school one-time pads, or anything like that. 55 00:02:38.230 --> 00:02:41.220 You can post your public key out on the internet for all to see. 56 00:02:41.220 --> 00:02:43.750 As long as you keep that private key secret, 57 00:02:43.750 --> 00:02:44.950 no-one else can read your messages. 58 00:02:44.950 --> 00:02:50.050 This is a system that has been tested under incredibly harsh conditions for decades. 59 00:02:50.050 --> 00:02:52.160 It works. 60 00:02:52.160 --> 00:02:54.030 The catch is, it's really unfriendly to use. 61 00:02:54.030 --> 00:02:57.310 It's difficult enough to get someone to join a new messaging service as it is, 62 00:02:57.310 --> 00:02:59.160 let alone bring their friends along. 63 00:02:59.160 --> 00:03:01.460 Now you have to generate these weird key things as well? 64 00:03:01.460 --> 00:03:04.100 And if you lose your phone or somehow forget that key, 65 00:03:04.100 --> 00:03:06.350 or your hard drive crashes and you haven't got a backup, 66 00:03:06.350 --> 00:03:10.230 all your messages are gone, lost as random noise forever. 67 00:03:10.230 --> 00:03:13.220 Email that works this way has been around for decades 68 00:03:13.220 --> 00:03:16.060 but it’s too complicated and it's too unfriendly for most people. 69 00:03:16.060 --> 00:03:18.480 The security wasn't worth the effort. 70 00:03:18.480 --> 00:03:19.810 So instead, web mail services, 71 00:03:19.810 --> 00:03:22.370 along with Facebook, Twitter, and everyone else, 72 00:03:22.370 --> 00:03:23.370 didn't worry about that. 73 00:03:23.370 --> 00:03:25.100 Early on, they were mostly unencrypted, 74 00:03:25.100 --> 00:03:27.180 but rapidly realised that was a bad idea -- 75 00:03:27.180 --> 00:03:29.300 so now, they use regular web encryption, 76 00:03:29.300 --> 00:03:30.920 that padlock in your browser, 77 00:03:30.920 --> 00:03:32.750 to make sure that no-one on your network can see 78 00:03:32.750 --> 00:03:36.030 your password or your messages when they’re in transit. 79 00:03:36.030 --> 00:03:38.850 And that's the threat that most people have to worry about. 80 00:03:38.850 --> 00:03:41.910 But they do have the content of those messages in plain text, 81 00:03:41.910 --> 00:03:43.040 or something close to it, 82 00:03:43.040 --> 00:03:45.550 and those companies can give that back to you whenever you want. 83 00:03:45.550 --> 00:03:48.700 Which means that when a government comes along with a legal warrant, 84 00:03:48.700 --> 00:03:51.100 the companies can also give the messages to them. 85 00:03:51.100 --> 00:03:52.640 And this was fine, right? 86 00:03:52.640 --> 00:03:53.640 This was reasonable. 87 00:03:53.640 --> 00:03:57.230 This was an acceptable compromise between security and usability. 88 00:03:57.230 --> 00:04:02.150 Or at least it was, until it was revealed that -- in short -- 89 00:04:02.150 --> 00:04:06.430 every major government was keeping a copy of pretty much everything everyone ever wrote, 90 00:04:06.430 --> 00:04:09.020 at which point a few companies decided, that, actually, 91 00:04:09.020 --> 00:04:13.250 they didn't want to take the risk of anyone -- not even their own employees -- 92 00:04:13.250 --> 00:04:18.400 being able to even theoretically access the messages that people were sending. 93 00:04:18.400 --> 00:04:23.050 The result is WhatsApp, and iMessage, and the many smaller apps like them. 94 00:04:23.050 --> 00:04:25.690 They have "end-to-end encryption". 95 00:04:25.690 --> 00:04:29.680 Your phone generates a public and private key for you, automatically. 96 00:04:29.680 --> 00:04:32.050 It exchanges public keys behind-the-scenes, 97 00:04:32.050 --> 00:04:33.650 while you're writing your first message to someone, 98 00:04:33.650 --> 00:04:35.190 and everything after that is encrypted. 99 00:04:35.190 --> 00:04:36.190 And it's all automatic! 100 00:04:36.190 --> 00:04:39.010 And so WhatsApp and iMessage aren’t open source, 101 00:04:39.010 --> 00:04:40.940 in theory they could steal your private key as well 102 00:04:40.940 --> 00:04:43.750 or quietly issue a fake one to someone and sit in the middle listening, 103 00:04:43.750 --> 00:04:45.890 but in practice people would notice. 104 00:04:45.890 --> 00:04:49.530 Sure, there are small loopholes that could work in particular circumstances, 105 00:04:49.530 --> 00:04:52.980 but the odds are remote, and security researchers are already 106 00:04:52.980 --> 00:04:57.820 decompiling and tearing apart every version of every messenger program 107 00:04:57.820 --> 00:05:00.390 just to see if someone's put a backdoor into it. 108 00:05:00.390 --> 00:05:01.620 The short version is: 109 00:05:01.620 --> 00:05:04.890 if any of these apps get served with a government warrant right now, 110 00:05:04.890 --> 00:05:08.370 the most they could do is say how much two people have been talking, 111 00:05:08.370 --> 00:05:10.410 and maybe roughly where they were: 112 00:05:10.410 --> 00:05:12.370 but never what they were talking about. 113 00:05:12.370 --> 00:05:16.310 More than that is literally, mathematically impossible. 114 00:05:16.310 --> 00:05:19.180 But it's impossible only because of the way they've designed their systems. 115 00:05:19.180 --> 00:05:21.970 And that is the vulnerability. 116 00:05:21.970 --> 00:05:24.760 A government could make it a legal requirement for Apple and Facebook 117 00:05:24.760 --> 00:05:28.000 to quietly add a backdoor in all their encryption 118 00:05:28.000 --> 00:05:30.240 if they want to sell anything in their country. 119 00:05:30.240 --> 00:05:32.450 I've heard this phrased as "outlawing maths", 120 00:05:32.450 --> 00:05:34.090 but that's a bit like saying that 121 00:05:34.090 --> 00:05:38.740 making punching a stranger in the face illegal is "outlawing hands". 122 00:05:38.740 --> 00:05:42.150 And if Apple and Facebook refuse to add a backdoor, a government could... 123 00:05:42.150 --> 00:05:45.830 well, theoretically they could ban their phones or ban their apps from sale, 124 00:05:45.830 --> 00:05:47.510 or prosecute the people in charge, 125 00:05:47.510 --> 00:05:49.880 or block Facebook, who own WhatsApp, 126 00:05:49.880 --> 00:05:52.410 or they could tell internet providers to block their services, 127 00:05:52.410 --> 00:05:53.610 or they could... 128 00:05:53.610 --> 00:05:56.480 Look, in practice they're going to fine the company. 129 00:05:56.480 --> 00:05:58.320 Apple and Facebook have local addresses, 130 00:05:58.320 --> 00:06:00.500 they pay... some tax. 131 00:06:00.510 --> 00:06:02.830 Sitting on the sidelines, I would love to see the British government 132 00:06:02.830 --> 00:06:05.970 go up against Apple and see who blinked first. 133 00:06:05.970 --> 00:06:09.310 But companies have bowed to foreign countries loads of times in the past. 134 00:06:09.310 --> 00:06:10.730 BlackBerry let the Indian government 135 00:06:10.730 --> 00:06:15.050 have full access to users’ chats and web history back in 2013. 136 00:06:15.050 --> 00:06:17.290 The only reason WhatsApp can't read your messages 137 00:06:17.290 --> 00:06:21.550 is because they have deliberately chosen to design their systems that way. 138 00:06:21.550 --> 00:06:23.260 They were just as popular without encryption: 139 00:06:23.260 --> 00:06:24.260 it was an afterthought, 140 00:06:24.260 --> 00:06:27.660 they'd been going for years before they switched encryption on. 141 00:06:27.660 --> 00:06:29.840 This was a human decision, 142 00:06:29.840 --> 00:06:33.139 not an inevitable fact of technology. 143 00:06:33.139 --> 00:06:36.260 So why is an encryption backdoor such a bad idea? 144 00:06:36.260 --> 00:06:40.100 Well, if there's a backdoor, it can and will be abused. 145 00:06:40.100 --> 00:06:42.420 Local British authorities already used our surveillance laws, 146 00:06:42.420 --> 00:06:45.090 the ones that were brought in to stop terrorism, 147 00:06:45.090 --> 00:06:47.300 to monitor loud dogs barking, 148 00:06:47.300 --> 00:06:48.900 crack down on illegal feeding of pigeons, 149 00:06:48.900 --> 00:06:51.630 and to spy on some parents to see if they actually lived near enough 150 00:06:51.630 --> 00:06:53.920 to a particular school they wanted to get their kids into. 151 00:06:53.920 --> 00:06:57.120 Now, is this useful for preventing crime? 152 00:06:57.120 --> 00:06:58.120 Sure. 153 00:06:58.120 --> 00:06:59.120 And there's the argument that 154 00:06:59.120 --> 00:07:01.050 "if you have nothing to hide, you have nothing to fear": 155 00:07:01.050 --> 00:07:03.950 maybe they shouldn't have illegally fed those pigeons. 156 00:07:03.950 --> 00:07:08.260 And yes, you, watching this, you probably have nothing to hide and nothing to fear 157 00:07:08.260 --> 00:07:11.650 from the current government in your country. 158 00:07:11.650 --> 00:07:14.669 But laws and governments change, and besides that: 159 00:07:14.669 --> 00:07:18.110 the internet, and the apps that we use on our phones, are global. 160 00:07:18.110 --> 00:07:19.740 If you allow a backdoor here, 161 00:07:19.740 --> 00:07:22.740 you're also allowing it for another country's government to spy on its opponents, 162 00:07:22.740 --> 00:07:25.710 and another to spy on people they suspect might be gay, 163 00:07:25.710 --> 00:07:27.200 or who use marijuana, 164 00:07:27.200 --> 00:07:28.200 or who are Christian, 165 00:07:28.200 --> 00:07:30.270 or whichever thing is illegal in that country. 166 00:07:30.270 --> 00:07:31.270 In fifty years, 167 00:07:31.270 --> 00:07:33.740 maybe you'll be part of a country where eating meat has been outlawed, 168 00:07:33.740 --> 00:07:37.830 and the government will want to come after you for tracking down 169 00:07:37.830 --> 00:07:41.810 the illegal bacon-trading ring that your friends are part of. 170 00:07:41.810 --> 00:07:44.810 "Nothing to hide" only works if the folks in power 171 00:07:44.810 --> 00:07:48.430 share the values of you and everyone you know entirely 172 00:07:48.430 --> 00:07:50.860 and always will. 173 00:07:50.860 --> 00:07:53.260 To make it worse, on the surface this seems like it's equivalent 174 00:07:53.260 --> 00:07:55.150 to a regular, old-school wiretap, but it's not: 175 00:07:55.150 --> 00:07:57.120 depending on how the backdoor’s set up, 176 00:07:57.120 --> 00:08:01.540 a government might not just be able to get what someone’s sending now. 177 00:08:01.540 --> 00:08:03.550 They could get the whole message history. 178 00:08:03.550 --> 00:08:05.980 Perhaps years of messages, back and forth 179 00:08:05.980 --> 00:08:08.140 with hundreds or thousands of other people. 180 00:08:08.140 --> 00:08:11.340 It's not just a look into what a person’s saying: 181 00:08:11.340 --> 00:08:15.260 it's an overreaching look into the thoughts of many, many people. 182 00:08:15.260 --> 00:08:19.110 it's that long-forgotten naked picture that someone sent five years ago. 183 00:08:19.110 --> 00:08:23.770 It's that angry essay they wrote in school and which they completely disagree with now. 184 00:08:23.770 --> 00:08:25.260 It's not just "what are they saying", 185 00:08:25.260 --> 00:08:28.199 it's "what have they ever said". 186 00:08:28.199 --> 00:08:33.229 That's all assuming the backdoor doesn't get abused by folks with more personal grievances. 187 00:08:33.229 --> 00:08:35.010 All it takes is one rogue employee, 188 00:08:35.010 --> 00:08:37.060 in the government or at a messaging app, 189 00:08:37.060 --> 00:08:41.260 and we've got a huge amount of personal information being leaked. 190 00:08:41.260 --> 00:08:42.790 Either of the public at large 191 00:08:42.790 --> 00:08:46.700 or of specific people that someone would like to take revenge on. 192 00:08:46.700 --> 00:08:48.640 It fails the "bitter ex test": 193 00:08:48.640 --> 00:08:50.091 can someone with an agenda 194 00:08:50.091 --> 00:08:51.430 use this to ruin a life? 195 00:08:51.430 --> 00:08:54.150 An AP investigation found hundreds of cases 196 00:08:54.150 --> 00:08:56.790 where police officers and civilian staff in the US 197 00:08:56.790 --> 00:08:59.760 looked up private information for personal reasons. 198 00:08:59.760 --> 00:09:03.020 And let’s not start on what would happen if a hacker, 199 00:09:03.020 --> 00:09:05.500 or even some other government’s intelligence service, 200 00:09:05.500 --> 00:09:07.390 got access to the backdoor. 201 00:09:07.390 --> 00:09:09.190 Or how it’d make it much more risky 202 00:09:09.190 --> 00:09:12.380 to report abuses of government power, on any scale. 203 00:09:13.400 --> 00:09:15.780 There is an argument that it would all be worth it, 204 00:09:15.780 --> 00:09:18.130 that all those drawbacks would be a small price to pay 205 00:09:18.130 --> 00:09:20.990 for stopping very rare Bad Things. 206 00:09:20.990 --> 00:09:24.920 I disagree, but that’s an opinion, not a fact. 207 00:09:24.920 --> 00:09:27.850 But an encryption backdoor wouldn’t stop bad things happening. 208 00:09:27.850 --> 00:09:31.910 The problem with stopping terrorism right now is not a lack of information. 209 00:09:31.910 --> 00:09:35.490 The Manchester bomber was reported to the authorities five times, 210 00:09:35.490 --> 00:09:38.100 including by his own friends and family. 211 00:09:38.100 --> 00:09:40.440 One anonymous source inside the UK security services 212 00:09:40.440 --> 00:09:44.560 told Reuters that at any time there are 500 people being investigated, 213 00:09:44.570 --> 00:09:47.250 and about 3,000 people "of interest". 214 00:09:47.250 --> 00:09:48.870 For scale, just to reassure you, 215 00:09:48.870 --> 00:09:51.529 that's only about .005% of the UK population. 216 00:09:51.529 --> 00:09:54.430 But the way to solve this is not more data, 217 00:09:54.430 --> 00:09:56.710 it's having enough police officers and security staff 218 00:09:56.710 --> 00:09:59.540 with enough time to do their jobs and investigate. 219 00:09:59.540 --> 00:10:04.450 And let's be clear: anyone who wanted secure communication for evil purposes 220 00:10:04.450 --> 00:10:06.220 would just use something else, 221 00:10:06.220 --> 00:10:09.510 any of thousands of smaller services that the government hasn’t noticed yet 222 00:10:09.510 --> 00:10:12.160 or that they couldn’t possibly have jurisdiction over. 223 00:10:12.160 --> 00:10:13.850 Or if even that is not an option, 224 00:10:13.850 --> 00:10:16.300 they can come up with a code themselves, 225 00:10:16.300 --> 00:10:19.890 even just in-jokes and references that no-one else understands. 226 00:10:19.890 --> 00:10:24.070 So when I say that an encryption backdoor sounds like a reasonable idea, 227 00:10:24.070 --> 00:10:25.070 I mean it. 228 00:10:25.070 --> 00:10:26.720 It sounds reasonable. 229 00:10:26.720 --> 00:10:30.839 Like a lot of ideas sound reasonable when you express them in one or two sentences. 230 00:10:30.839 --> 00:10:33.339 But the devil is in the detail. 231 00:10:33.339 --> 00:10:35.770 If we could replicate the way wiretaps used to work, 232 00:10:35.770 --> 00:10:37.580 limited in scope and time, 233 00:10:37.580 --> 00:10:39.780 requiring a warrant and some physical effort, 234 00:10:39.780 --> 00:10:43.080 not including the history of everything that someone's ever said, 235 00:10:43.080 --> 00:10:45.339 and not open to repressive governments elsewhere in the world, 236 00:10:45.339 --> 00:10:49.420 then sure, I would absolutely be in favour of it. 237 00:10:49.420 --> 00:10:52.040 Building an encryption backdoor isn't impossible: 238 00:10:52.040 --> 00:10:54.180 but building a reasonable one is. 239 00:10:54.800 --> 00:10:57.100 Thank you to everyone who helped proofread my script, 240 00:10:57.100 --> 00:11:00.560 and to everyone here at the Cambridge Centre for Computing History, 241 00:11:00.570 --> 00:11:02.820 who let me film with this wonderful old equipment.