I hear you on that, and I agree that the legal system is the root (or I’d say the *conduit*) for what’s happening here.

Right now though, our side’s voice isn’t loud enough to compete with all the high-profile causes on the political action front. Changing that is the primary motivation behind the “secure yourself & educate the next guy” strategy.

And you’re right… crypto isn’t safe from malicious legislators right now. But if we can bring about a culture where honest people — the ones who “have nothing to hide” — are more likely than not to use crypto, it’s going to be much harder for the other side to put the toothpaste back in the tube.

Maybe those who “have nothing to hide” are comfortable posting their bank & credit card information on a public website, or letting random strangers remotely view the entire contents of their home PC. And maybe they wouldn’t mind if on her next visit, Cousin Selma used the house PC and accidentally found a copy of all the juicy gossip a certain someone wrote about her & Aunt Beatrice a while back. Hey, perhaps they’re even cool with having the “powers that be” (you know, the ones up above them on the org chart at work) know their login & password on Monster or Yahoo Jobs – and what’s more, know all their blog & journal pseudonyms where they vent about how badly their job sucks.

After all, they have nothing to hide.

Honest people with nothing to hide have plenty to hide — with legitimate & honorable reasons too. They just need to understand that, which means providing them with examples that hit them where they live.

Know anyone who’s been phished? Imagine: Phishing could be a moot endeavor, much less likely to pay off – if electronic transactions were predominantly executed using a four-way hash of the sender’s & recipient’s secret keys – both a personal AND an account key for each party, none of which could be had by cracking into the financial institution’s website.

Know any victims of identity theft? Help them imagine a distributed network of open-source, community & volunteer run “check my ID” web services — kind of like a “Do not call” registry, applied as a “Do not open accounts in my name” registry. Help them imagine an Identity Theft Prevention Act which guaranteed that credit accounts opened in the name of anyone registered with such a service could not legally be associated with them for financial responsibility or credit reporting purposes without having been validated with their nearly-impossible-to-forge digital signature. Help them imagine their identifying info being held in a lock box that only they held the key to, so that nobody, not even the hosting website’s programmers & admins, could view it.

All this and more is possible right now, with today’s cryptographic security. Most people just have no idea what can be done with this. So someone’s gotta tell ’em.

Bob next door doesn’t need to know how to pronounce Rijndael, nor know what RSA stands for, nor know what the hell asymmetric means. (My own downfall is putting Bob to sleep in my zeal to explain all that. Honestly, he could give a crap and there’s nothing I can do to change that. 😉 But that’s okay, ’cause really, all he needs to get his mind around is the concept of people having electronic “lock boxes,” where you need one key to put stuff in & another to get stuff out. It’s not quite accurate, but it’ll do for Bob.

Sally doesn’t need to get what makes crypto signatures work, so long as she can understand something akin to having a digital thumbprint that’s written in invisible ink, or that’s concealed with a secret code that’s unique for every document or message in the universe. If she gets that any third party can tell if she really signed it, but cannot duplicate the signature even though it’s there in plain sight, that’s good enough for now.

I’m sure others can easily best me in the sloppy-but-useful metaphor department, so have at it. How would you get a newbie to trust digital signatures as strong proof of the origin of things, or illustrate the benefits of using them? How would you sell Uncle Ernie on dealing with that extra click or two to make sure only Aunt Emma could read what he was writing?

I for one will rest easier when it’s safe to assume you can send anyone an asymmetrically secured email — without having to explain how to read it, how to verify that it isn’t forged, or how to see if it’s been tampered with in transmission. In a culture where such is commonplace, it would be suicide for a politician or agency to try to take out crypto. In a society where people count on electronic keys to keep snoops & crooks out of their important stuff, it’ll really come across as shady for some official to claim that the gov’t ought to have a copy of everyone’s keys. In that world, my ISP can accumulate whatever bits & bytes they’re told to waste their storage on; 7 years worth of routing history and transmitted packets won’t compromise my privacy. If the government has reason to suspect me of unlawful activity, they can still obtain a warrant for the relevant search space. But neither they nor anyone else can sift my private data without my knowlege & consent, and insofar as I have “nothing to hide,” I’m fine with that and I think it’s a pretty good balance. For Americans, this might even sound vaguely like some stuff the founding fathers talked about.

When things like the above come to pass, the collective voice of privacy advocates just *might* have risen to a suitably audible level in Washington. Who knows, maybe someday we can even think about making *forward progress* on electronic freedom, instead of feeling like we’re always doing triage, picking our battles & trying to prevent the most grevious wounds to our rights of privacy and free speech. Hell, let’s even dream really big & let’s look forward to a really decisive victory: Imagine being in control of our music players & TV sets again!

But it all starts with Uncle Ernie, and that dweeb two cubes down from you.