How Can Privacy and Security Work Together?

TL;DR

Privacy and security must be pursued together because strong encryption protects personal data, national interests, commerce, and connected systems from criminals and nation-states. Creating exceptional access for authorities could sacrifice those broad protections, while ignoring legitimate investigative needs would also carry serious risks. Society must continually reassess legal boundaries as technology evolves.

Transcript

Ladies and gentlemen, please welcome moderator, Venture Partner, Rally Ventures, Art Coviello Jr. Good afternoon, everyone. At the opening of the conference, I said that the issue of privacy and security is the defining issue of the digital age. What we have going on now with Apple versus the FBI, talk about backdoors and encryption, is only sympto... Read More

Key Insights

• Privacy and security are complementary values because personal privacy depends on protecting data from criminals and nation-states, while security without respect for privacy would undermine the liberties and values that national institutions are supposed to protect.
• End-to-end encryption is a broad security mechanism that gives individuals control over their data and helps defend commerce, intellectual property, connected devices, and industrial systems against unauthorized access and potentially damaging attacks.
• Exceptional access creates a strategic tradeoff because enabling authorities to enter selected phones or data systems may weaken protections that serve a much larger population and an increasingly digitally dependent economy.
• Economic espionage is presented as a national security threat because stolen research, business plans, intellectual property, and product information can be transferred to countries able to manufacture and distribute goods more cheaply and quickly.
• The Internet of Things increases the consequences of weak cybersecurity because attacks against connected industrial control systems can move beyond stolen information and produce physical damage, property loss, or loss of life.
• Privacy and security are not a binary choice because societies must protect individual rights while also recognizing legitimate physical security, law enforcement, and national security responsibilities.
• National security officials can value privacy while pursuing threats because their responsibility to prevent attacks and save lives coexists with legal duties, personal privacy concerns, and experience as victims of major data theft.
• Technology requires continuing policy negotiation because each new connected product changes expectations of privacy, investigative capability, and security risk, making a permanent resolution between individual rights and state responsibilities unlikely.

Questions & Answers

Q: Why are privacy and security not opposing goals?

Privacy and security reinforce each other because private information cannot remain private when systems are vulnerable to criminals, foreign governments, or other attackers. At the same time, security that disregards privacy would erode the individual rights and social values being protected. The panel therefore rejects a simple tradeoff and argues that both goals must be pursued together through law, technology, and continuing public discussion.

Q: Why does the panel support end-to-end encryption?

The panel supports end-to-end encryption because it allows people and organizations to control and secure their data against numerous threats. Its value extends beyond protecting individual phones. Encryption also supports commerce, safeguards intellectual property, and helps defend connected devices and industrial systems. Weakening that protection to assist particular investigations could expose a much broader range of information and infrastructure to unauthorized access.

Q: Why did Mike McConnell change his view on encryption?

Mike McConnell says he previously advocated an escrowed-key approach called the Clipper Chip, but his experience during the digital age changed his assessment. He concluded that the country had become deeply dependent on digital systems for commerce, trade, and interaction. The continuing extraction of intellectual property and business information through economic espionage persuaded him that ubiquitous encryption served a greater national good.

Q: What national risk does economic espionage create?

Economic espionage creates strategic harm by removing intellectual property, research and development, business plans, and new product information from the country. McConnell argues that stolen information can be transferred to a country with cheaper labor and faster manufacturing and distribution capabilities. Because the country increasingly depends on innovation and creation, persistent theft can weaken its economic position and broader national security.

Q: How does the Internet of Things change the encryption debate?

The Internet of Things expands the debate from the privacy of phones to the safety of connected physical systems. Chertoff warns that attacks against industrial control systems can cause real-world consequences, including property damage and loss of life. O'Connor similarly points toward connected homes, cars, schools, institutions, and daily activities, making dependable security protections increasingly important across society.

Q: What does the privacy community want national security officials to understand?

Privacy advocates also care about national safety and want citizens and children to be protected. Their analysis often begins with the Bill of Rights and asks whether the rights of individuals or the authority of the state should take priority in a particular situation. They are concerned that rules designed for phones will shape a future in which homes, cars, schools, institutions, and daily life are connected.

Q: What does the national security community want privacy advocates to understand?

National security officials carry a serious responsibility to prevent attacks that could kill large numbers of people. Chertoff describes situations involving threat information in which officials had to make every possible effort to identify the source and stop the danger. He also stresses that officials generally value privacy, seek to obey the law, and may personally experience the consequences of stolen private information.

Q: Can society permanently resolve the privacy and security debate?

A permanent resolution is unlikely because new technologies repeatedly change the practical meaning of privacy, security, and government access. Trevor Hughes describes the issue as an ongoing social negotiation about where boundaries and expectations should be set. Privacy and security must coexist even when they are not perfectly harmonious, so laws and policies will need continued reconsideration as new connected technologies enter daily life.

Summary & Key Takeaways

• The panel treats the Apple and FBI encryption dispute as one symptom of a larger conflict over privacy, law enforcement, and national security. Participants largely support end-to-end encryption because it protects personal information, intellectual property, commerce, and increasingly connected systems from criminals, foreign governments, and other digital threats.

• Michael Chertoff and Mike McConnell argue that weakening encryption could create greater strategic harm than the investigative benefits it provides. McConnell describes changing his position after recognizing the country's digital dependence and the scale of economic espionage, while Chertoff emphasizes physical risks arising from attacks against connected industrial systems.

• Nuala O'Connor and Trevor Hughes reject privacy and security as a binary choice. They argue that advocates on both sides value safety, liberty, and lawful government, although they begin from different responsibilities. The appropriate boundaries require continuing negotiation as phones, homes, vehicles, schools, institutions, and other parts of daily life become connected.