FBI Withholds 69 Pages of TrueCrypt-Related Documents, Most Of Which Can Already Be Found Online
from the DEFAULT:-HIDE dept
Weird TrueCrypt-related things keep happening. Over the past few years, TrueCrypt has gone from "recommended by Snowden!" to a service of questionable trustworthiness. To begin with, it was never clear who exactly was behind TrueCrypt and the lack of a recent security audit wasn't winning it many new converts.
Things went from somewhat bad to disturbingly worse when, shortly after the first phase of the audit was completed, a post went up at SourceForge declaring the software insecure and that all development had been halted. The post pushed users towards BitLocker. Further development was left to the public and more testing seemed to indicate it was still trustworthy, even though it relied on possibly predictable random number generator.
Whether or not TrueCrypt can fully be trusted remains up in the air. But there's some indication that the FBI has taken an interest (probably an unhealthy one) in TrueCrypt's inner workings.
Techdirt reader dfed sends in a tweet from security researcher Runa Sandvik, along with a link to her FOIA request to the FBI for TrueCrypt-related documents. What has been "returned" to her has been completely withheld, all 69 pages of it. The FBI cites FOIA exemption b(4) which covers "trade secrets and commercial and financial information."
The documents that won't be making their way to Sandvik appear to be three technical articles not written by FBI personnel and ones that have appeared elsewhere in unredacted form.
In further explanation of the withholding, the material consists of three, copyrighted articles: Easy to Crack USB Thumbdrives, March 12, 2008 by Daniel Bachfeld; EEEP Net: "FOUO Network", April 2014 by Greg Fulk; Techno Forensics Conference, October 2007 at NIST by Dave Reiser, and a training slide presentation, Anti-Forensics, November 2, 2007 by Secure Computing.The 2008 article may be somewhat related to the FBI's failed attempt to crack TrueCrypt encryption protecting hard drives owned by Brazilian banker Daniel Dantas, who was suspected of several financial crimes. The Brazilian government asked for the FBI's help after spending five months of its own attempting the same thing. A year later, the drives remained intact.
The thing is, Daniel Bachfeld's article on crackable USB drives can be found online. And it was previously published in a German tech magazine. Once again, we see a government agency withholding publicly-available information simply because that's its natural tendency: to keep requesters and requested documents as far away from each other as possible.
The presentation by Dave Reiser was given at a conference that is open to members of the public, as well as the law enforcement community, so there's no reason for secrecy there. And Paul A. Henry's anti-forensics presentation, which discusses TrueCrypt, can be found online as well.
So, why is the FBI holding these back? Nothing in these papers discusses anything that could possibly be considered a "trade secret." If these are secrets, they're pretty open. Searching for "anti-forensics" turns up a wealth of scholarly papers and presentations that discuss both encryption and TrueCrypt.
This is just the FBI obfuscating for obfuscation's sake. But its knee-jerk reaction to withhold everything in its entirety also suggests something slightly more troubling. Either the intelligence/investigative arms of the US government have found a way in (by obtaining keys or compromising the RNG) or they're still very actively involved in trying to do so. Neither bodes particularly well for TrueCrypt users.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
Copyright?
[ link to this | view in chronology ]
I can't help but wonder if there might not be a causal relationship at work here?
[ link to this | view in chronology ]
What's the problem?
[ link to this | view in chronology ]
Re: What's the problem?
What's troubling to me is that the FBI might be spending government funds on this... when the NSA and NIST BOTH have a mandate in this area, and the FBI doesn't. Why not just let the NSA and/or NIST do the TC audits, and then the FBI can ask them for the results? If there's that much separation between departments, we have other really troubling issues that have nothing to do with the FBI attempting to crack TrueCrypt.
[ link to this | view in chronology ]
Has been Audited
[ link to this | view in chronology ]
Re: Has been Audited
[ link to this | view in chronology ]
Re: Re: Has been Audited
[ link to this | view in chronology ]
Step 2: Laugh as the FBI sends these documents fully redacted with black ink.
Step 3: Download the unredacted documents from their original sources or any other uncesored source.
Step 4: Reply to the FBI, saying that their document was unreadable, so you did them a favor and removed all of the black ink for them. Attach said unredacted document.
Step 5: Hilarity.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
FBI FUD
[ link to this | view in chronology ]
How hypocritical of them
[ link to this | view in chronology ]
HT used it/TC's seppuku
That was a rather poor write up on the end history of TC, Tim. Actually, that's an understatment, but I'll just leave it at that.
Most educated people came to the conclusion that the wierd, 'canary' like message from TC's anon dev, which included the conspicuous phrase "Not Secure As", along with the completely absurd bitlocker suggestion (amoung others), was indicative of mounting advasarial pressure, and a potential/probable future compromise. If anything it gave us more reason to trust TC. A strong case can be made that the devs words/actions where a form of digital seppuku, and very clever speech under some duress.
As others have mentioned, TC has now been fully audited and found to be without any serious flaws. I hope veracrypt will be (is being?) given the same treatment- until then I'll stick with the original.
[ link to this | view in chronology ]
I personally believe the auditors somehow offended the TrueCrypt developers. Maybe something was said that rubbed them the wrong way. I think the TrueCrypt developers decided it's not worth their time and effort to continue maintaining software for a bunch of ungrateful people who keeps insulting them.
Maybe they just decided they have better, more fun, things to do with their free time. I don't blame them.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
Doesn't that seem like an emotion reaction to you and like sticking one's middle finger at the auditors?
[ link to this | view in chronology ]
Re:
The NSA, seeing that TrueCrypt was undergoing an audit with very good results that would drive more people to use it, decided that they needed to make a move.
The developers were located and were being pressured to hand over their signing keys so the software can be covertly backdoored or weakened.
The developers, not wanting this to happen, handed over the keys to avoid repercussions but also put up their special message, effectively ending the project (NSA trying to start it back up again/pretend the website was defaced would be met with intense scrutiny).
[ link to this | view in chronology ]
I'd find links but i'm a very lazy dopped up to my eyes on Demerol because of an open fracture of the foot.
[ link to this | view in chronology ]
Reasonable Suspicion versus Reactive Stupidity
The FBI referenced the articles. You found them. That the FBI didn't violate the authors' or publishers' copyrights by serving them up to you, for copying costs, on a platter doesn't appear to (reasonably) point to some sinister intent.
Let's not dilute the valid indications of bad acts by government by getting hysterical about the reasonable, and lawful, acts.
[ link to this | view in chronology ]