Privacy versus security. How to balance the two is an age-old, enduring debate, though when we say “privacy” these days, often what we are talking about is our personal digital security.
“It’s not privacy versus security. It’s really security versus security,” is how Republican U.S. Rep. Michael McCaul of Austin phrased it during a meeting with the editorial board on Wednesday.
However it’s framed, Congress has been reluctant to try to find a digital balance between individual and business security and national security. We support a proposal by McCaul aimed at moving Congress beyond its reluctance.
McCaul, who chairs the House Homeland Security Committee, and Democratic U.S. Sen. Mark Warner of Virginia have called on their colleagues in Congress to establish a commission to study digital security issues. McCaul and Warner hope the commission’s recommendations guide Congress toward consensus and action that will allow the federal government to protect Americans against terrorist attacks without exposing consumers and technology companies to hackers and government intrusion.
If created as McCaul and Warner propose, the National Commission on Security and Technology Challenges will have 16 members, with eight members appointed by the Republican leaders of the House and Senate and eight members appointed by the chambers’ Democratic leaders. Their proposal allows for the president to appoint one nonvoting member to the commission.
The proposal requires that commissioners be selected for their expertise in technology, law enforcement, national security, and civil liberties and privacy. Once assembled, the commission would have six months to send Congress an interim report and 12 months to produce a final report — a tight time frame driven by what McCaul called a rapidly changing “terrorist landscape” and “terrorism gone viral.”
McCaul said his concern is how to stop a Paris-style attack from happening in the United States. The attackers who killed 130 people in Paris in November were part of a new generation of technologically sophisticated terrorists who use encrypted messaging applications to create a “dark space” where they can communicate and plot without being detected by national security and law enforcement officials.
“If you can’t see what they’re saying, then it’s hard to stop a terrorist plot,” McCaul said.
McCaul and Warner began working on their commission proposal a year ago, but it arrives as a legal battle between Apple and the federal government has taken over the national conversation about digital security. The FBI wants Apple to help it access the data on an iPhone used by Syed Farook, who, with his wife, Tashfeen Malik, killed 14 people in San Bernadino, Calif., in December. The iPhone’s encrypted security features protect user’s information by destroying it when someone attempts to guess the user’s pass code. Too many wrong guesses and the data is wiped. The problem for Apple is that to unlock Farook’s phone for the FBI, it would have to construct a “backdoor” into its operating system. Such a backdoor potentially could make all iPhones vulnerable to hackers, criminals and governments.
The Justice Department has accused Apple of creating a “warrant-proof” phone. Apple worries the government wants it to engineer a warrant-less phone. Last month, a federal judge in California ordered Apple to help the FBI. Apple refused. Each side is scheduled to makes its case in federal court on March 22.
McCaul called this “war of the courts” between Apple and the FBI unfortunate and counterproductive. As a former U.S. attorney, he said he gets the FBI’s point of view: The agency obtained a court order; Apple should comply. At the same time, McCaul said he understands Apple’s perspective and appreciates the company’s concerns about the potential exploitation of any crack in its encryption features.
McCaul sees the Apple case as primarily an “evidentiary” issue. He worries about stopping future terrorist attacks. He hopes a commission on digital security can facilitate “a national dialogue to provide solutions to the Congress” so it can respond to a complex problem thoughtfully and carefully. The alternative is to risk a broad, knee-jerk response with unintended consequences.
It is in Congress, not the courts, where this issue should be resolved. Encryption is essential for protecting consumers, commerce, businesses and the nation’s infrastructure, but it is challenging for national security and law enforcement. Too many members of Congress have chosen to hope that the need to balance personal security and national security somehow magically goes away, or that the courts will settle the issue. But such a resolution in the courts will take years — and there will be conflicting rulings along the way that only will add to the confusion.
Consider that the law governing the Apple case, the All Writs Act, was passed in 1789. Though the law has been modified several times in the 227 years since, the legal authority governing the Apple case nonetheless remains rooted in an act passed by the very first Congress of the United States and signed into law by President George Washington.
It’s time to move from the era of the quill pen into the digital age.
Digital security at SXSW
U.S. Rep. Michael McCaul, R-Austin, and U.S. Sen. Mark Warner, D-Virginia, will discuss their proposal to create a commission on digital security from 11:15 a.m. to 12:15 p.m. Saturday at the Capital Factory, 701 Brazos St. This is not an official South by Southwest Interactive event and does not require a SXSW badge.
McCaul also will be part of a SXSW panel from 5 to 6 p.m. Saturday titled “American Innovation and Cybersecurity.” The panel takes place in the Omni’s Capital Ballroom, 700 San Jacinto St. A SXSW badge is required.