Midway through this piece (at 4:20) is what I found most interesting. It gives an interesting perspective on a sort of solution for the NSA surveillance. While she readily admits NSA not doing it would be best, she points out that homomorphic encryption is a more realist solution. It is a middle ground which gives both privacy and surveillance.
- At the very least, if you must do that, there's something called homomorphic encryption, which simply means that you encrypt the data and you can engage in data analysis on the encrypted values. It allows you to do surveillance on the encrypted values so no one's personal information is in plain text. Then, only if you get a hit and it meets the threshold you develop, on potentially terrorist activity, you get a court order, a warrant, and you decrypt that data.
Basically, they already fuck our privacy and can see all of our stuff and look in on loved ones, etc. At least this takes that aspect away and adds some checks and balances back into the mix. It gives them the ability to run surveillance on the encrypted data and detect potential terrorists without actually giving the ability to read every single thing.
Once detected they would apply for a warrant in order to decrypt the data.
Food for thought. Anyone have any opinions on this? Is it worth considering this sort of "meet in the middle" approach considering they have been and will continue doing surveillance regardless? Or is this "giving in" to too much?
thenewgreen I think this is super interesting especially in regards to your upcoming podcast.
Enjoy.
Homeomorphic encryption is very cool, and Youssef Gahi and co have a scheme that sounds like it could work for a lot of applications, all those that can do everything they need to within a relational database, but you still have to commit to performing only certain operations on your data, and that's a pretty big risk for many applications (suddenly you really need a more tailored caching scheme, but you can't implement one with the operations you have). It's likely only every going to happen for every well-understood applications, and the big players would have to decide it was worth constraining themselves to provide that kind of security because there's no way "NetFlix, but with homeomorphic crypto!" or "Google, but with homeomorphic crypto!" are going to displace Netflix or Google if that's their only distinction.