Paris Attacks Fuel Debate Over Spying

(by Damian Paletta and Siobhan Hughes, The Wall Street Journal) WASHINGTON—A growing belief among intelligence officials that the terrorists behind Friday’s Paris attacks used encrypted* communications is prompting a far-ranging re-examination of U.S. policy on data collection and surveillance. [*encrypt – to change (information) from one form to another especially to hide its meaning]

Sen. Richard Burr (R-NC), chairman of the Senate Intelligence Committee, said Tuesday his panel will launch a review of encryption use. Sen. Tom Cotton (R-Ark.) introduced a bill to extend a sweeping telephone data-collection program due to expire at month’s end.

Sen. Burr, emerging from a briefing by senior intelligence officials, said it appeared the terrorists used extensively shielded communications.

“It is likely that end-to-end encryption was used to communicate in Belgium and France and Syria,” Sen. Burr said. He said encryption was likely because no direct communication among the terrorists was detected.

U.S. counterterrorism officials haven’t yet found evidence that the Paris suspects—who are believed linked to Islamic State—used encrypted communications to plan or carry out the attacks. But they expect that as the investigation advances they will find some communications among them were encrypted, according to multiple officials.

Since the attacks of Sept. 11, 2001, the public and policymakers have swung between emphasizing the need for security agencies to have access to data, and protecting personal privacy. That pendulum has arguably shifted more toward privacy in recent years—a position promoted by technology companies that sell products based on the promise that corporate data will be secure from hackers and government surveillance.

But initial signs suggest the Paris attacks have the potential to push it back toward security, a move opposed by many public-interest groups, especially since the 2013 revelations by Edward Snowden about government data-collection practices.

A renewed push to give law enforcement and intelligence investigators more power to decrypt commercially sold technology could set Washington on a collision course with Silicon Valley. Many technology companies have rejected law enforcement requests for “back door” coding that would give investigators access to secure communications. Software products are being marketed with a promise that they can’t be decoded, Sen. Burr said, and that might have to change.

“We don’t have a responsibility to sell their products,” the senator said. “We have a responsibility to keep America safe…And if it means that people are going to have to change their business models, then so be it.”

Sen. Tom Cotton, Republican, Arkansas

Sen. Cotton’s bill would pause the expiration of a broad phone data-collection program run by the National Security Agency (NSA), which is set to end Nov. 29, until the president certifies that a planned replacement is equally effective. [See “Background” below the questions.]

The NSA program sweeps up data on millions of calls, such as who called whom, though not the content of the conversations. Under the new version that Sen. Cotton’s legislation would put a hold on, the NSA could get the information from phone companies only if it obtains a court order. “If we take anything from the Paris attacks, it should be that vigilance and safety go hand-in-hand,” Mr. Cotton said. …

Still, the concerns about government intrusiveness that have risen on the right and left (with conservatives and liberals) in recent years, especially since the NSA program was revealed by Mr. Snowden, won’t suddenly disappear.

Rep. Michael McCaul (R-TX), chairman of the House Committee on Homeland Security, warned Tuesday against a thoughtless reaction to the attacks, and suggested a commission be set up to make recommendations to Congress.

“I don’t want us to do a knee-jerk response in legislation and make an unintended consequence,” Congressman McCaul said.

For years, intelligence and law enforcement officials, pushing for greater access to personal information, have squared off against privacy advocates and technology firms who fear government overreach. The question is whether the Paris attacks could change that dynamic.

On Monday, CIA Director John Brennan blasted “a lot of handwringing over the government’s role,” saying the resulting curbs on investigators have made efforts to track terrorists “much more challenging.” He added, “I do hope that this is going to be a wake-up call.” …

The attacks have already renewed a sharp debate over whether technology companies should install “back doors” to encrypted data [so intelligence agencies can access it]. The White House has sought the cooperation of technology companies in this area, but concluded recently that forcing the issue would only stir up resistance. That issue may now be revisited.

Sen. Dick Durbin (D-Ill.), the second-ranking Democrat in the Senate, said the U.S. needs to be sure it has the tools to fight the kind of terrorism that unfolded in Paris. “We know that we need to change the approach when it comes to the encryption of data in communications,” Sen. Durbin said.

Sen. Dick Durbin, Democrat, Illinois (Photo: Andrew Burton/Getty Images)

Privacy advocates argue that back doors would build vulnerabilities into programs that could be exploited by terrorists as well as overzealous government officials.

Rep. McCaul, speaking at an event organized by the Software and Information Industry Association, waved his own phone and declared, “You don’t want to put a backdoor in this device, because then you open it up to hackers, and also people think the government is in their iPhones or Androids.”

Rep. Will Hurd (R-TX), a former CIA officer, also warned against overreaction. “Our civil liberties are what make our country great, and they’re not burdens,” he said. “Encryption is good and we shouldn’t do anything to weaken it.”

—Devlin Barrett contributed to this article.

Copyright 2015 Dow Jones & Company, Inc. All Rights Reserved. Reprinted here for educational purposes only. May not be reproduced on other websites without permission from The Wall Street Journal. Visit the website at wsj .com.