Can we solve Challenge (A)? if so how? What are the key paradigms? How do we maximize the accountability, proficiency and morality of the governance of the certification and oversight? Should such certifications governance be international and primarily non-governmental? What scale of investments are needed? The role of uncompromising “zero trust” security-by-design paradigms? The role of transparent and extreme review and oversight of all critical lifecycle components and human processes?What is the role citizen-witness and citizen-jury processes? Is it realistic to secure enough CPUs and chip fabrication oversight? The role of free/open-source software and testing by expert “ethical” hackers?  The role of blockchains, quantum computing, artificial intelligence?

If we can solve (A), do we necessarily also need to solve (B) in order to avoid major public security issues and/or its outlawing? If YES, can we solve (B) and how? Can the same radically unprecedented technical and organizational safeguards needed for (A) also – within current laws – mitigate the inevitable added risks of voluntarily providing lawful access compliance such that it’ll still radically exceed the security of the best IT solutions available, that do not provide such access?
While German and EU banks, enterprises, security agencies and military seem to understand the dire need for (B) – though hardly suggesting a solution – most EU civil rights organizations, think tanks,and many EU politicians think that solving (B) is either not needed and/or not possible. Are they right?

Can IT compliant to such certifications radically mitigate the risks and costs of cybercrime and GDPR? What are the economic opportunities for public and private organizations that are pioneering such new ecosystems? Can we imagine a parallel ultra-secure hardware and software computing universe, as a user-friendly supplement to every-day computing devices? Can mandating adoption of such new certifications for state bulk and targeted cyber-investigations programs radically increase their effectiveness, integrity and resilience from abuse? Can mandatory adoption for elected officials, presidential candidates (!) – and critical military and civilian IT – increase both citizens’ and state sovereignty and public safety.

Recent Intel, AMD and Ledger hacks reveal how critical vulnerabilities – mostly inserted or “let be” by states – run deep, down to CPU and chip fabrication, and their certifications. Meanwhile, Shadow Brokers and CIA Vault 7 revelations further show how these state-grade hacks are ever more widely available to criminals.

Need for a whole new level of security is increasing in enterprises, banks, governments and citizens for their communications and transactions, and more so with GDPR mandatory disclosure requirements. After the Cambridge Analytica scandal, a great need is emerging for ways to meaningfully enforce algorithmic transparency and security for Artificial Intelligence and social media.   Adoption of blockchains is hampered by severe open security challenges due the severe lack of adequate standards and certification for core software, smart contracts, ecosystems governance and client endpoints.

Although, cybersecurity spending has grown 30 times in the last 10 years to $120 billion in 2017 – and forecasted at $1 trillion in 2021 – the cost of cybercrime will skyrocket to a forecasted $6 trillions per year in 2021. Nevertheless, market demand remains almost entirely latent because current cybersecurity certifications are proven ever more inadequate in depth, comprehensiveness, and independence to deliver the security needed for critical scenarios and enabling users to even compare high-security solutions, except based on reputation.

However, the slow progress of new certifications plans in EU and the unresolved NSA efforts to undermine NIST standards add up to other evidence that this state of affairs is not a “by accident” but “by design”. It is primarily due to the need of nations to prevent “at all costs” criminals to use IT devices that are resistant to a duly authorized lawful access order. Soon after algorithmically unbreakable encryption was made widely available in 90s and nations felt the need to resort to breaking everything below it in the lower technical and lifecycle stacks.

The Head of ENISA agency, former President of German BSI, recently highlighted the centrality of deeper certifications: “From a certification perspective, a regulation perspective, it would be a good idea to look into these kinds of hardware products, protocols, and think about how to do a certification scheme for these… If you start in hardware from the beginning, you build on top of it. Everything is secure from the beginning”.

The EU and EU members states invest in R&D and centers to promote strong encryption, with one hand, while they increasingly invest and share to break those same technologies, with the another. In fact, although overall state security agencies have not “gone dark” nor are “going dark“, the availability of the proposed new certifications and IT systems would by definition create a “could be going dark” problem.

Prospects for a wide availability of meaningfully-secure IT may, therefore, be inextricably linked to ensuring that a legitimate privacy-respecting lawful access to such systems is somehow granted.