Reflections on Ten Years Past The Snowden Revelations

Interesting post from the IETF reflecting on learning of the last ten years since Edward Snowden leaked documents on the NSA surveillance programs.

Now that some years have past, it seems appropriate to reflect on that period of time, what effect the community's actions had, where security has improved, how the threat surface has evolved, what areas haven't improved, and where the community might invest future efforts.

Bruce Schneier begins this compendium of individual essays by bringing us back to 2013, recalling how it was for him and others to report what was happening, and the mindset of those involved. Next, Stephen Farrell reviews the technical community's reactions, technical advances, and where threats remain. Then Farzaneh Badii discusses the impact of those advances – or lack thereof – on human rights. Finally Steven M. Bellovin puts the Snowden revelations into an ever-evolving historical context of secrets and secret stealing that spans centuries, closing with some suggestions for IETF.

This reads like four different articles (blog posts?) put together into one paper with sections. I found section 5, the article from Bellovin on Governments and Cryptography the most interesting.

Strong cryptography was here to stay, and it was no longer an American monopoly, if indeed it ever was. The Information Assurance Directorate of the NSA, the part of the agency that is supposed to protect U.S. data, was pleased by the spread of strong cryptography. When the Advanced Encryption Standard (AES) competition was held, there were no allegations of malign NSA interference; in fact, the winning entry was devised by two Europeans, Joan Daemen and Vincent Rijmen. But the NSA and its SIGINT needs did not go away—the agency merely adopted other techniques.

Also would agree strongly with the point in section 3 by Farrell:

In particular, we (the technical community) haven't done nearly as good a job at countering surveillance capitalism which has exploded in the last decade.

Interesting perspective from an important body, the IETF. Themes on encryption echo my comments in Polarizing Technology.