Meredith WhittakerThis is the real, human cost of mass surveillance of everyone's private digital communications.
If we actually care about keeping people safe, we need more end-to-end encryption not less.
Rix@Mer__edith The biggest hurdle I see for true E2EE is companies trying to make it as easy and transparent as possible. E2EE in that form will always be insecure. If you can sync the key across devices there is no guarantee that the company won’t be subpoenaed to change their code to make extracting the key easy for LE.
True E2EE is the private key is stored on a device that does not support exporting the key. Unfortunately this still requires a technical background to get 100% correct.
@Mer__edith To add insult to injury the same people who would benefit most from E2EE refuse to use it because they claim “I have nothing to hide” because they conflate encryption with doing illegal shit, not realizing that their decision to not encrypt their communications means they are more likely to be under surveillance because they are the weakest links in the chains.
The next post has a scenario that is likely in these kinds of situations.
@Mer__edith Alice is friends with Bob who is friends with Sam. Sam and Bob both use E2EE to communicate back and forth and Alice does not.
Say Bob was to relay to Alice where Sam was going to be that day. An innocuous request that most people wouldn’t consider out of the ordinary. Alice didn’t use E2EE so let’s pull Facebook in and say they were privy to the message between Bob and Alice. Facebook now reports that Sam is at planned parenthood to LE for possible abortion/transgender care.
@Mer__edith Even though Sam and Bob used E2EE, Bob and Alice failed OPSEC and their communications were more likely to be intercepted for information about Sam.
A lot of people seem to think that the 4th amendment protects you from this kind of surveillance but it’s been seen time and again. As far as LE goes your online accounts are fair game. They just need to get a judge to sign their subpoena and show probable cause. Companies will not protect you. It’s a group effort that keeps us safe.