The Ten Commandments of Encryption Policy

So many politicians, bureaucrats, and pundits are proposing weakening our crypto to allow searches by law enforcement without understanding the issue, that I thought it'd be good to have a quick reference to explain why this is a bad idea. Feel free to copy this and send to politicians, news reporters, or anyone else you think needs to know this.

The Ten Commandments of Encryption Policy

1. In Applied Cryptography (2nd Ed., John Wiley & Sons, 1996), Bruce Schneier wrote: "There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files." Therefore, anything that allows our government to read our messages will automatically put our crypto into the "kid sister" category.
   
   
2. Anything that allows government to read your message will also allow hackers to read your message. Cryptography is just math, and math works the same for everybody. It doesn't distinguish between good people and bad, or who has a warrant and who doesn't.
   
   
3. When strong crypto is outlawed, only outlaws will have strong crypto. The encryption genie is already out of its mathematical bottle. Weakening our crypto so our governments can read it will only make us vulnerable to hacker groups and terror organizations like ISIS, who will have no hesitation about breaking the law to use strong crypto themselves.
   
   
4. "If you have nothing to hide, you have nothing to worry about" is a very dangerous mantra. Just ask anyone who's had their identity stolen.
   
   
5. When people talk about giving law enforcement authorities access to our data, remember that they're talking about the same law enforcement authorities who illegally tapped Martin Luther King Jr.’s phones.
   
   
6. Terror attacks, mass shootings, and mass hackings are all proof that we cannot rely on laws to protect us. We need to protect ourselves with math. Protecting our data is too important to be left to governments.
   
   
7. Always remember that lawmakers want solutions that are visible, that they can point to and say, "See? It works." But security solutions that actually work are invisible. People go about their lives unaware of the attacks they were protected from. People don't notice the days their house doesn't get burgled.
   
   
8. Don't be caught up in considering how much security you "need." You won't know how much that is until after the worst happens and it's too late. We need to be able to give ourselves every last bit of security that we can.
   
   
9. Before you bring up the founders or the Constitution, remember that they themselves often communicated using ciphers. Thomas Jefferson even invented a wheel cipher for this purpose.
   
   
10. We need to consider the consequences of constant observation. Every bit of human progress began as an idea that most people opposed. The last thing we want to do is make people afraid to express those ideas.