Encrypting Our Way to Less Crime

Last week, Manhattan District Attorney Cyrus Vance Jr. took to the editorial pages of the New York Times to continue his campaign against Apple’s and Google’s decisions to turn on strong encryption by default on smartphones running their newest software. In an op-ed titled “When Smartphone Encryption Blocks Justice,” which he co-wrote with law enforcement officials from the U.K., France, and Spain, New York City’s top prosecutor once again argued that by securing smartphones in such a way that only their users can unlock them, Apple and Google are undermining law and order.

This debate has now been raging for nearly a year, and almost everyone outside of law enforcement—including even the former heads of the National Security Agency and the Department of Homeland Security—has concluded that strong encryption is good for security and that putting backdoors into encryption for law enforcement is bad for security for a wide variety of reasons. The New York Times piece won’t inspire many people to change their minds—the examples and arguments are incredibly weak, as several other commentators pointed out. (For example, Vance complains about a locked Samsung Galaxy S6 Edge frustrating a murder investigation—yet encryption is not turned on by default on those phones, nor is it even clear that it was turned on in that case.)

However, Vance and his co-authors are right about one thing: Criminals will make use of encryption technology, just as they have leveraged pretty much every other technology in general use. (Another advanced technology that can shield crimes from prosecution: curtains.) But they ignore the simple fact that default encryption on smartphones will prevent millions of crimes, including one of the most prevalent crimes in modern society: smartphone theft. In the long run, widespread smartphone encryption will ultimately preserve law and order far more than it will undermine it.

When it comes to smartphones, we are living in the midst of a criminal epidemic. There were 3.1 million victims of smartphone theft in 2013, nearly double the number in 2012, according to 2014 estimates by Consumer Reports. According to the same report, only one-third of smartphone users bother to require passcodes to access their phones, while another third take no steps at all to secure the data on their phones. In that environment, Apple’s decision to secure our phones for us using default encryption—thereby deterring theft and protecting the data on stolen phones by making them inaccessible to anyone but their users—is not surprising and is indeed deserving of praise rather than condemnation. What is surprising is to hear top law enforcement officials criticizing a technology that could stem the tide of this criminal epidemic that impacts millions of Americans.

The Federal Communications Commission’s 2014 numbers are a bit lower thanConsumer Reports’ but still indicate annual smartphone thefts considerably in excess of 1 million—but that number is based solely on law enforcement records of reported thefts, and the FCC suggests that such thefts are underreported. Even based on this lower number, though, the FCC concludes that at least one-tenth of all thefts and robberies committed in the United States are associated with the theft of a mobile device. Another study by the security firm Lookout included an equally concerning “1 in 10” number: One in 10 smartphone owners are victims of phone theft.

In comparison, Vance cites only 74 cases where the Manhattan district attorney’s office encountered an encrypted iPhone it couldn’t unlock—that is, substantially less than 0.1 percent of the approximately 100,000 cases it handles per year. Meanwhile, according to the FCC’s numbers, more than one-quarter of all thefts in New York City, and more than half of all grand larcenies from a person, involved a smartphone. In other words, Manhattan’s DA, in pursuit of 74 cases, is arguing against a technology that would help prevent tens of thousands of other crimes. You may think that those 74 cases are much more serious than mere smartphone thefts—but as the FCC said when announcing the launch of new initiatives to combat the smartphone theft epidemic, “Robberies are, by definition, violent crimes, and there are many instances of robberies targeting cell phones resulting in serious injury or even death.”

The increasing prevalence of “kill switch” software on some smartphones (which allows an owner to remotely disable a phone that’s been swiped) has helped deter smartphone theft and bring those numbers down somewhat—Consumer Reportsestimated 2.1 million in 2014, down from 3.1 million in 2013. However, those are still epidemic-level rates, and kill switches—even if turned on by default—have serious shortcomings that default encryption doesn’t. First, the consumer has to actually choose to flip the switch and brick the phone after it’s been stolen. Second, the signal instructing the smartphone to lock itself actually has to reach the phone. That can’t happen if the crooks just turn the phone off and then take some trivial steps to block the signal, or ship the phone out of the country, before turning the phone back on to reformat it for resale. (Smartphone theft is increasingly an international affair for which kill switches are not a silver bullet.) And finally, enterprising hackers are always working to provide black market software solutions to bypass the locks, which is one of the reasons why there is a thriving market for even locked smartphones, as demonstrated by a quick search on eBay. Those same hackers, however, would be decisively blocked by a strong default encryption solution.

Encryption would thereby help reduce the serious economic impact of smartphone theft—one researcher estimates that it costs Americans $2.6 billion per year, based on the cost of insuring and replacing stolen phones. But default encryption wouldn’t just help prevent the crime of phone theft—or the violence that sometimes attends it. Default encryption also and obviously prevents follow-on crimes that could be committed using access to a phone’s data, such as ID theft or fraud. As onefascinating study by the security company Symantec demonstrated, phone thieves will almost certainly go after the data on your stolen phone in addition to or instead of just trying to profit from sale of the hardware itself. In that study, Symantec deliberately “lost” 50 identical cellphones stocked with a variety of personal and business apps and data, then studied how the people who found the unsecured phones interacted with them. The upshot of the study: Almost everyone who got hold of one of the phones went straight for the personal information stored on that phone. Ninety-five percent of the people who picked up a phone tried to access personal or sensitive information, or online services like banking or email. Yet only half of those people made any attempt to return the phone—even though the owner’s phone number and email address were clearly marked in the contacts app.

And this isn’t just about personal data—83 percent of the smartphone finders tried to access corporate-related apps and data, with 45 percent attempting to access corporate email. That’s just one of many of the reasons why the FBI itself recommends encrypting your phone, even as FBI Director James Comey has joined Vance in his anti-encryption crusade. So default encryption doesn’t only protect individuals—it can also help guard the cybersecurity of companies and government agencies whose employees use smartphones. Especially as the storage capacity and range of uses for smartphones and other mobile devices steadily increases, smartphone encryption will play an increasing role in preventing cybersecurity breaches that implicate the privacy of thousands or even millions of people.

Vance and his co-authors baselessly assert that “there is no evidence that [full-disk encryption] would address institutional data breaches,” yet even a cursory look at the history of data breaches makes clear that default encryption would’ve prevented—and will prevent—countless data leaks. Indeed, encryption by default could have stopped the federal government’s first high-profile mass data breach, in 2006, which involved the theft of a laptop with 26.5 million veterans’ sensitive information including Social Security numbers. There wouldn’t have been a breach at all if that information had been encrypted. Default encryption would have also prevented countless other similar government and corporate breaches before and since. Default encryption would’ve been a good idea for laptops then; now it’s a good idea for smartphones, given that they rival those past laptops in terms of storage and power and range of use.

With all due respect for the very hard job of law enforcement, Vance and his co-authors are shortsightedly arguing against their own interests. The question isn’t whether default encryption for mobile devices will frustrate some criminal investigations. (It certainly will.) The question is whether there will be more or less crime in a world with default encryption, and the clear answer is that there will be many fewer crimes—fewer stolen smartphones, fewer robberies and assaults, fewer identity thefts and fraudulent transactions, fewer mass data breaches. Vance and his co-authors say they want justice. If that’s true, then they should support rather than attack the spread of encryption technology. The more widespread encryption is, the safer we all will be.

This article is part of Future Tense, a collaboration among Arizona State University, New America, and Slate.