Solution Providers: Proposed State-Level Encryption Legislation Would Hamper Our Ability To Protect Mobile Customers

Solution providers and some state representatives are decrying state-level efforts to weaken encryption for iPhones and Android phones, saying it would weaken smartphone security and raise costly issues for manufacturers.

Weeks ago, state bills released by New York and California proposed to ban the sales of smartphones with encryption features that cannot be unlocked by the manufacturer. These bills, which supporters argue would aid law enforcement offices in counterterrorism investigations, target the privacy policies of manufacturers such as Apple and Samsung, which refuse to add a "back door" -- or keys to encrypted software and devices -- to their devices.

The debate deepened Wednesday after Rep. Ted Lieu, D-Calif., and Rep. Blake Farenthold, R-Texas, disputed the bill, releasing their own opposing bill that would prohibit efforts to weaken encryption.

[Related: Paris Attacks Reignite Controversy In Security Industry Over Encryption Technologies]

Solution providers such as Matt Johnson, CEO of Millersville, Md.-based Phalanx Secure Solutions, said the initial legislation, if issued in his own state, would hamper his ability to protect his customers with encryption technologies.

"I think [this initial legislation] would be a hit [to us] in that it would give us one less avenue to protect our clients," Johnson said. "If we can't create that layer of mobile encryption, then their mobile devices are at risk and their business data is at risk."

The latest legislation fits into a growing narrative around encryption that started with whistleblower Edward Snowden and was reignited after the Paris and San Bernardino attacks this past fall. Legislators and other government officials have argued that encryption hampers their ability to prevent terrorist attacks, but the security industry has pushed back, saying the technologies are critical to preventing more large-scale breaches.

David Felton, founder of Norwalk, Conn.-based reseller Canaan Technology, whose company partners with Microsoft and Cisco Systems, said that more of his customers are talking about encryption as it relates to their business' security and protection of data than in previous years.

"We do get a few calls from clients asking about encryption; this has been happening for several years now," he said. "They are asking about email security and encryption. I don’t think their intent in asking about encryption is to circumvent the government, but instead recognizing the threat of hackers."

That's a trend that Pravin Kothari, founder and CEO of CipherCloud, a cloud security company based in San Jose, Calif., that sells encryption technologies, said he has also seen. He said more customers are becoming interested in buying encryption technology because of recent privacy concerns as well as a move to cloud and mobile technologies.

"There is a huge pickup [around] encryption technology. The awareness of it is huge, not just at the business level but at the consumer level. ... I've never seen such a huge awareness of the problem that I’m seeing now in the encryption world," Kothari said.

Kothari said legislators' hearts are in the right place when it comes to protecting national security, but these particular pieces of legislation are an "overreaction" to recent events without evaluating the pros and cons.

"I think there are solutions, but the current stance from the state government to ban encryption and weaken encryption, they are not the real solution. That will only help bad guys and also impact the good guys," Kothari said.

The legislation would also impact manufacturers, which would need to completely redesign their iPhones and Android phones on a state-by-state basis, Canaan Technology's Felton said.

"I think it's a bad idea to let any government, whether local, state or federal, try to have back doors put on hardware encryption," he said. "This would create big problems for manufacturers -- they would have to create phones specific to a state law, and if forced to do that, a company like Apple may not sell in certain states."

That awareness makes encryption an area ripe for investment for solution providers, said Phalanx Secure Solutions' Johnson. He expects Phalanx Secure Solutions will launch a coordinated push around selling encryption technologies to its small- and midsize-business clients in the next quarter.

"We shouldn't be limiting security because of what could happen. Everyone has needs and should have needs for privacy," Johnson said.