Security without IoT Mandatory Backdoors

Carl Hewitt (1, 2)

1 MOHC - Met Office Hadley Centre
2 Standard IoT

https://plus.google.com/+CarlHewitt-StandardIoT/ The Internet of Things (IoT) is becoming pervasive in all aspects of life including personal, corporate, government, and social. Adopting mandatory backdoors for every IoT device ultimately means that security agencies of each country surveil IoT in their own country and perhaps swap surveillance information with other countries. Security agencies have proposed that it must be possible for them to secretly access and take control of any individual IoT device. However adopting their proposal would make it very difficult to prevent them from accessing and controlling large numbers of devices and abusing their surveillance capabilities. Also, adopting mandatory backdoors would be corrosive to civil liberties because any phone, body-sensor computer network, TV, and other IoT device could be secretly accessed and controlled without any awareness by those present using the device. A critical security issue is that after a mandatory backdoor has been exercised to take control of a citizen’s IoT device without their awareness, the device thereby becomes somewhat less secure because of potential vulnerabilities in the new virtualized system used to take control of the device. Distributed Encrypted Public Recording (DEPR) is system in which distributed public and private organizations keep encrypted electronic records of all activity that takes place in public places including tracking automobiles, cell phones locations, humans (using facial recognition), and all financial transactions. The records can be decrypted only by court subpoena using both a key kept by the recording establishment and a key provided by the court. If not subpoenaed within a time set at recording, the recordings cannot read by anyone (enforced by cryptography using a trans-national distributed Internet time authority). In addition to ensuring that outdated information cannot be decrypted, the trans-national time authority can provide continual statistics on the amount of decrypted information as a deterrent to mass surveillance. Advanced Inconsistency Robust information technology can be a very powerful tool for catching criminals using DEPR. Using DEPR is a less risky to citizen security than requiring mandatory backdoors for all IoT devices.

Mots clés: mandatory backdoors; surveillance; IoT; distributed public recording

Domaines: Ingénierie, finance et science [cs.CE]

Carl Hewitt. Security without IoT Mandatory Backdoors: Using Distributed Encrypted Public Recording to Catch & Prosecure Criminals. 2016. ⟨hal-01152495v12⟩