The Obama Administration's Encryption Wrangling

The Washington Post reported Wednesday that:

White House officials have backed away from seeking a legislative fix to deal with the rise of encryption on communication devices, and they are even weighing whether to publicly reject a law requiring firms to be able to unlock their customers’ smartphones and apps under court order.

. . .

[O]ver the summer, momentum has grown among officials in the commerce, diplomatic, trade and technology agencies for a statement from the president “strongly disavowing” a legislative mandate and supporting widespread encryption, according to senior officials and documents obtained by The Washington Post.

The main document in question is this one, entitled "Review of Strategic Approaches":

NSC Draft Options Paper on Encryption

As the Post story reflects, the document lays out three options for the administration—three options that notably do not include seeking legislation on encryption.

They are:

• "Option 1: Disavow Legislation and Other Compulsory Actions";
• "Option 2: Defer on Legislation and Other Compulsory Actions"; and
• "Option 3: Remain Undecided on Legislation or Other Compulsory Actions."

In all honesty, it probably doesn't matter all that much which of these options Obama chooses. If these are the choices on the table, industry has already won.

From the inside of an interagency process, these fights always seems high stakes. From outside of it, however, I'm not sure how important this one really is any more. Unless the administration were to seek legislation and get it, after all, anything else it would do on the subject is just temporary verbiage that will be up for reevaluation in barely a year when a new administration comes in.

What's really the difference between saying that the administration is not seeking legislation "at this point" (option 2) and saying that "having a broad discussion about this is essential" and hosting discussions about the subject (option 3)? Even if the administration were to strongly disavow encryption regulation (option 1), the next administration could simply come in and seek it anyway.

To be sure, the different options would set different tones. Disavowing legislation would send a message of rebuke to the law enforcement and intelligence communities, and it would also involve a rebuke to allies that are considering the sort of compelled access regimes the President would be disavowing. It would also signal a go-ahead to industry to implement strong encryption systems that, given the lobbying power of the companies in question, might be difficult for a subsequent administration to backtrack on. Conversely, leaving the question open might encourage companies to work with law enforcement on a non-compulsory basis to find solutions, though I tend to doubt that. But all that said, none of these represent a course this or the next administration couldn't change if circumstances required.

Some of us still remember that the United States once had a pretty firm position against targeted killing in counterterrorism.

The big message from this paper is one about the power of industry in this debate. The powerhouse federal agency known as Apple has gone head to head with the FBI in the interagency process, and this NSC memo reflects the fact that Apple is winning. The debate now is whether that win will take the form of an overt victory—in which the President openly and publicly sides with the companies against his deputy attorney general and his FBI director—or whether it will take the form of formal agnosticism or delay. Either way, it will amount to the same thing: the US will do nothing for now, and industry will be free to implement whatever encryption systems it wants—at least until future administrations, or future events, pull things in a different direction.

I'm not sure if that's the right answer or the wrong answer, but it is a vivid illustration of how overrated the power of the so-called national security state really is when its interests don't coincide with those of Silicon Valley.