政府爲何不應要求加密信息訪問權
Many things in life are desirable but unachievable. Personally, I would love to play chess as well as Magnus Carlsen but I somehow doubt that is going to happen.
It is a similar story with politicians demanding “exceptional access” to private encrypted communications. It is perfectly understandable why security services desire such powers. In the wake of the murderous attacks in Manchester and London, who would not want to tap the electronic traffic of terrorist suspects?
政治家們要求對私人加密通信享有“特殊訪問權限”，也是類似情況。爲何安全部門要求取得這等權力，是完全可以理解的。在曼徹斯特和倫敦遭遇兇殘襲擊之後，誰不想竊聽恐怖主義嫌疑分子的電子通信內容？But governments should be extraordinarily careful before forcing technology companies to comply. At worst, their demand may be unattainable in the messiness of the real world; at best, it could result in enormous cost and complexity. The unintended consequences of such action could also be appalling. Mandating insecurity in technological systems, which run so much of the critical infrastructure of the modern world, is inherently a bad idea.
但是，政府在強迫科技公司服從之前，應當非常謹慎地考證這個問題。在最糟糕的情況下，他們的要求在亂糟糟的真實世界裏也許無法實現；在最理想的情況下，這個要求也可能帶來巨大的成本和複雜局面。這種做法的意外後果也可能很可怕。在技術系統中加入不安全因素——現代世界如此多關鍵基礎設施由技術系統管理——本身就是個壞主意。
Why this is so has been clearly spelt out by a collection of academic computer scientists in a paper called “Keys Under Doormats”.
這個主意不好的原因，在多名學術型計算機科學家所寫的一篇名爲《門墊下的鑰匙》(Keys Under Doormats)的論文中得到了清晰的闡述。This group studied the practical challenges of providing security agencies with the exceptional access that they demand. Their conclusion: “These proposals are unworkable in practice, raise enormous legal and ethical questions, and would undo progress on security at a time when internet vulnerabilities are causing extreme economic harm.”
這些科學家研究了向安全部門提供他們所要求的特殊權限的現實挑戰。他們的結論是：“這些建議在現實中不可行，會造成巨大的法律與道德問題，並將在互聯網薄弱環節帶來極端經濟危害之際，使安全領域的進步毀於一旦。”There are three main problems.
這裏有三個主要問題。First, governments may rail against end-to-end encryption, which is increasingly being used by technology providers, including Facebook’s WhatsApp and Apple’s iMessage, to ensure that communications remain secure. But creating a master key enabling law enforcement agencies to unlock these communications creates enormous jeopardy.
第一，政府也許會抱怨端對端加密。包括Facebook的WhatsApp和蘋果(Apple)的iMessage在內，許多技術提供商都越來越多地使用這一手段來確保通信的安全。但是，創建一把萬能鑰匙，使執法機構可以解鎖這些通信內容，會帶來巨大的危險。The Edward Snowden affair showed that the US government has a hard time keeping many of its own secrets secret. The damage that would be wrought if that master key were compromised or stolen scarcely bears thinking about. The WannaCry ransomware that recently crippled the computer systems of hundreds of organisations around the world sprung out of an “exploit” originally developed by the US National Security Agency.
愛德華?斯諾登(Edward Snowden)事件表明，美國政府連自己的許多祕密都很難保管好。如果萬能鑰匙被損壞或被盜，後果不堪設想。不久前讓世界各地數百家機構計算機系統陷入癱瘓的“想哭”(WannaCry)勒索軟件，就源自美國國家安全局(NSA)當初開發出的一個“漏洞利用工具”。The second challenge is that encrypted communications not only ensure confidentiality but also authentication: they give you confidence that you are communicating with whom you think you are. But if you can read encrypted communications you can also forge them. This opens up new security vulnerabilities injecting uncertainty into all other communications. Imagine if the Russians were able to forge messages between officials in the Trump administration. On second thoughts?.?.?.?maybe that explains a lot.
第二個挑戰是，加密通信不但確保機密性，也會確保真實性：它讓你確信，你認爲自己在跟誰通信，你就確實在與他/她通信。但是，如果你能讀取加密通信，你也就能僞造通信內容。這帶來了新的安全漏洞，向所有其他通信注入了不確定性。想象一下，如果俄羅斯人能夠僞造特朗普(Trump)政府官員之間的通信內容，會怎麼樣。轉念一想……這也許解釋了許多問題。Third, who would legally be able to lay claim to the master key? It may be one thing for security officials in law-based democracies to exercise such powers within their own countries. But it is quite another when data flow across borders as so much of it does. Governments at both ends of any communication chain would surely demand reciprocal rights for access from tech companies. How happy would a US executive be to send any email or message to a counterpart in China knowing that Beijing had the capability to read anything it chose?
第三，在法律上，誰將有能力對萬能鑰匙主張所有權？法治的民主國家裏的安全官員在本國行使這種權力，或許是一回事。但當數據跨越國界流動（許多數據確實跨國界流動）時，這就是另一回事了。任意通信鏈兩端的政府，將肯定要求科技公司給予對等的信息訪問權。在知道中國政府有能力讀取自己想要了解的任何信息的情況下，一位美國高管會有多樂意向一位中國高管發送任何電郵或消息？There are other instances when we decide that what is technically feasible may be practically undesirable. For example, ground controllers could be given the capability to seize the controls of all commercial aeroplanes to counter the threat from hijackers or suicidal pilots. But not many passengers would fly in aeroplanes so vulnerable to being hacked.
還有其他事例說明，有時候我們判定在技術上可行的事情，在現實中也許是有害的。例如，地面管制員可能獲得授權，能夠接管所有商業飛機的控制權，以應對來自劫機者或想自殺的飛行員的威脅。但是，系統如此容易被侵入的飛機，是不會有很多乘客願意搭乘的。It is easy to see why governments have been lashing out at tech companies. Politicians are desperate to do everything they can to combat terrorism and want every weapon they can grab. Besides, the tech companies have hardly endeared themselves to the public by disowning responsibility for so much outrageous content that appears on their sites.
很容易理解，政府爲何一直猛烈抨擊科技公司。政客們渴望竭盡所能對付恐怖主義，想要得到他們能抓到手的每一件武器。此外，科技公司對這麼多出現在自己網站上的可怕內容撇清責任，一直不受公衆待見。Undoubtedly, they could — and should — do more to expunge material that fuels extremism. There are encouraging signs that they are doing just that.
毫無疑問，科技公司可以——並且應當——採取更多措施，清除那些助長極端主義的內容。有一些令人鼓舞的跡象顯示，它們正在這麼做。But to force them to make encrypted communications less secure would be a risky and potentially counterproductive move. Far better for governments to collaborate with those tech companies in myriad other lawful ways to counter the terrorist scourge.
但是，迫使科技公司把加密通信變得不那麼安全，將是一種冒險的、可能適得其反的舉動。政府最好藉助各種合法手段，與那些科技公司合作對付恐怖主義禍害。
