In 2011, the United Nations declared Internet access a universal human right. That was a necessary step forward for digital freedom, but it’s far from sufficient; we think encryption needs to be added to the list. Even in free societies with ample access to the Internet, the freedom to use the Internet means nothing if we don’t have privacy, and privacy means nothing if we don’t have encryption. That chain of logic isn’t obvious to everyone, so let’s break it down in reverse:
Why is encryption necessary for privacy?
Without a technical background, most people are forced to imagine encryption as a padlock. When you send an encrypted message over the Internet, its contents are “locked” to everyone but the recipient, who holds the only key. “That’s nice,” you might say. “But what if someone breaks the lock without the key? What if someone has a blowtorch?” That’s where the metaphor breaks down. With physical locks, there’s always a way to pick them, saw them, or melt them open. And if a lock is solid enough to resist all but the most motivated (and well-financed) lock-pickers, then the lock itself is probably too expensive for the general public.
Encryption, however, is not a physical lock. Encryption is software. Once written, it costs virtually nothing to maintain and distribute. That’s important because the more things we encrypt, the stronger our online privacy. If only sensitive information is encrypted, encryption becomes a signal to surveillance organizations that the information inside is worth monitoring!
But more importantly, unlike physical locks, encryption is protected by the laws of mathematics, which are unbreakable in the purest sense possible. The standard encryption algorithm RSA, for example, is based on factoring, i.e. solving a multiplication problem in reverse. You can multiply two prime numbers to get a very large number (i.e. hundreds of digits long), but you’d need a supercomputer and more than a few lifetimes to waste if you wanted to figure out which two numbers you started with.
That makes encryption the only practical tool we have to keep data private even if it is intercepted. Like Edward Snowden said, “Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on.”
Why is privacy necessary for freedom?
“Okay,” you might be saying at this point, “I can see why criminals would need privacy. But I have nothing to hide. The NSA isn’t interested in my chocolate chip cookie recipes.” Perhaps not. But the issue is less about the information gained by those who spy on us, and more about what it does to us.
Surveillance changes us. It’s a well-documented psychological phenomenon; people simply behave differently when they know they are being watched, and usually not for the better. Observation impairs performance, damages trust, and encourages conformity in those being observed. It doesn’t matter whether you have any skeletons in your closet; just the fact that your closet is open for scrutiny limits your decisions about how you dress, walk, talk, and interact with other people. You might unconsciously start to act more like the people around you.
That’s an especially tragic consequence for societies that purport to be “free”. Neil Richards, Professor of Law at Washington University in St Louis, sums it up beautifully:
When we are watched, tracked and monitored, we act differently. There’s an increasing body of evidence that internet surveillance stops us from reading unpopular or controversial ideas. Remember that our most cherished ideas — that people should control the government, that heretics should not be burned at the stake and that all people are equal — were once unpopular and controversial ideas. A free society should not fear dangerous ideas, and does not need complete intellectual surveillance. Existing forms of surveillance and policing are enough.
A step in the right direction
With the growing need for encryption in a free society, it’s no surprise that the U.N. has taken special interest. In a 2015 report from the Office of the High Commissioner for Human Rights, special rapporteur David Kaye says:
Encryption and anonymity, and the security concepts behind them, provide the privacy and security necessary for the exercise of the right to freedom of opinion and expression in the digital age. Such security may be essential for the exercise of other rights, including economic rights, privacy, due process, freedom of peaceful assembly and association, and the right to life and bodily integrity.
That’s a firm step toward progress, but the report did make an allowance for “court-ordered decryption” on a “case-by-case basis” (the equivalent of giving the TSA a universal key to your luggage). Companies like Google, Microsoft, and Apple have spoken out against similar legislation in the U.S., despite the president remaining “sympathetic” to law enforcement. Let’s hope the U.N. continues to be sympathetic to the link between encryption and freedom itself.