FBI Withholds 69 Pages of TrueCrypt-Related Documents, Most Of Which Can Already Be Found Online

from the DEFAULT:-HIDE dept

Fri, Jul 10th 2015 6:05am — Tim Cushing

Weird TrueCrypt-related things keep happening. Over the past few years, TrueCrypt has gone from "recommended by Snowden!" to a service of questionable trustworthiness. To begin with, it was never clear who exactly was behind TrueCrypt and the lack of a recent security audit wasn't winning it many new converts.

Things went from somewhat bad to disturbingly worse when, shortly after the first phase of the audit was completed, a post went up at SourceForge declaring the software insecure and that all development had been halted. The post pushed users towards BitLocker. Further development was left to the public and more testing seemed to indicate it was still trustworthy, even though it relied on possibly predictable random number generator.

Whether or not TrueCrypt can fully be trusted remains up in the air. But there's some indication that the FBI has taken an interest (probably an unhealthy one) in TrueCrypt's inner workings.

Techdirt reader dfed sends in a tweet from security researcher Runa Sandvik, along with a link to her FOIA request to the FBI for TrueCrypt-related documents. What has been "returned" to her has been completely withheld, all 69 pages of it. The FBI cites FOIA exemption b(4) which covers "trade secrets and commercial and financial information."

The documents that won't be making their way to Sandvik appear to be three technical articles not written by FBI personnel and ones that have appeared elsewhere in unredacted form.

In further explanation of the withholding, the material consists of three, copyrighted articles: Easy to Crack USB Thumbdrives, March 12, 2008 by Daniel Bachfeld; EEEP Net: "FOUO Network", April 2014 by Greg Fulk; Techno Forensics Conference, October 2007 at NIST by Dave Reiser, and a training slide presentation, Anti-Forensics, November 2, 2007 by Secure Computing.

The 2008 article may be somewhat related to the FBI's failed attempt to crack TrueCrypt encryption protecting hard drives owned by Brazilian banker Daniel Dantas, who was suspected of several financial crimes. The Brazilian government asked for the FBI's help after spending five months of its own attempting the same thing. A year later, the drives remained intact.

The thing is, Daniel Bachfeld's article on crackable USB drives can be found online. And it was previously published in a German tech magazine. Once again, we see a government agency withholding publicly-available information simply because that's its natural tendency: to keep requesters and requested documents as far away from each other as possible.

The presentation by Dave Reiser was given at a conference that is open to members of the public, as well as the law enforcement community, so there's no reason for secrecy there. And Paul A. Henry's anti-forensics presentation, which discusses TrueCrypt, can be found online as well.

So, why is the FBI holding these back? Nothing in these papers discusses anything that could possibly be considered a "trade secret." If these are secrets, they're pretty open. Searching for "anti-forensics" turns up a wealth of scholarly papers and presentations that discuss both encryption and TrueCrypt.

This is just the FBI obfuscating for obfuscation's sake. But its knee-jerk reaction to withhold everything in its entirety also suggests something slightly more troubling. Either the intelligence/investigative arms of the US government have found a way in (by obtaining keys or compromising the RNG) or they're still very actively involved in trying to do so. Neither bodes particularly well for TrueCrypt users.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: fbi, foia, redaction, truecrypt

19 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

MDT (profile), 10 Jul 2015 @ 6:23am

Copyright?
I wonder if they redacted them due to them being Copyrighted by some other entity, and used the wrong reason out of habit? That at least I could see as a legitimate reason to not distribute them, despite them already being in the wild. As whacky as CR law is nowdays, they could be liable for CR infringement for responding to a FOIA request.
[ link to this | view in thread ]
Mason Wheeler (profile), 10 Jul 2015 @ 6:44am

Over the past few years, TrueCrypt has gone from "recommended by Snowden!" to a service of questionable trustworthiness.
...
Either the intelligence/investigative arms of the US government have found a way in (by obtaining keys or compromising the RNG) or they're still very actively involved in trying to do so. Neither bodes particularly well for TrueCrypt users.

I can't help but wonder if there might not be a causal relationship at work here?
[ link to this | view in thread ]
Anonymous Coward, 10 Jul 2015 @ 6:52am

What's the problem?
The point of open source is that anyone is allowed to look at the code, even people with whom you may disagree. I agree that much of the redaction is needless, but the idea that the FBI is studying software it encounters is not surprising or alarming.
[ link to this | view in thread ]
Anonymous Coward, 10 Jul 2015 @ 7:07am

Has been Audited
The audit found no major problems. https://www.schneier.com/blog/archives/2015/04/truecrypt_secur.html
[ link to this | view in thread ]
The Groove Tiger (profile), 10 Jul 2015 @ 7:51am

Step 1: Send FOIA request to FBI to get these "secret" documents.
Step 2: Laugh as the FBI sends these documents fully redacted with black ink.
Step 3: Download the unredacted documents from their original sources or any other uncesored source.
Step 4: Reply to the FBI, saying that their document was unreadable, so you did them a favor and removed all of the black ink for them. Attach said unredacted document.
Step 5: Hilarity.
[ link to this | view in thread ]
The Groove Tiger (profile), 10 Jul 2015 @ 7:54am

Re: Has been Audited
Also, the fork named VeraCrypt supposedly added somewhat stronger encryption (or larger keys or whatever). Not backward compatible tho, so you need to move all your stuff to new volumes.
[ link to this | view in thread ]
Anonymous Coward, 10 Jul 2015 @ 7:58am

Re:
Step 6: Humorless FBI agents burst through your doors with machine guns drawn to arrest you for hacking and terrorism.
[ link to this | view in thread ]
Anonymous Coward, 10 Jul 2015 @ 8:51am

I think the FBI is trying to tell us something with the number of redacted pages.
[ link to this | view in thread ]
Anonymous Coward, 10 Jul 2015 @ 9:05am

Re: What's the problem?
I agree... the whole idea behind good crypto is that it is good crypto no matter how many eyeballs look at it. More exposure (even to those who you don't want finding flaws) is a GOOD thing.

What's troubling to me is that the FBI might be spending government funds on this... when the NSA and NIST BOTH have a mandate in this area, and the FBI doesn't. Why not just let the NSA and/or NIST do the TC audits, and then the FBI can ask them for the results? If there's that much separation between departments, we have other really troubling issues that have nothing to do with the FBI attempting to crack TrueCrypt.
[ link to this | view in thread ]
Mike Graham, 10 Jul 2015 @ 9:35am

FBI FUD
The gubment is trying to sully truecrypt because they don't want it in use. Probably because they cannot crack it.
[ link to this | view in thread ]
Adam (profile), 10 Jul 2015 @ 10:01am

How hypocritical of them
It's not redacted! It's encrypted! Funny how FOIA requests about encryption related subjects come back redacted. I mean, what? There's something they don't was us to see there?
[ link to this | view in thread ]
R.H. (profile), 10 Jul 2015 @ 2:58pm

Re: Re: Has been Audited
Actually, starting with version 1.0f, it is backwards compatible. In order to get the new strengthened encryption you have to move to new volumes but, I switched over to VeraCrypt a few months ago and was able to seamlessly change my headers to the new format without having to store everything in the clear, create new volumes, and move it back across.
[ link to this | view in thread ]
Anonymous Coward, 10 Jul 2015 @ 6:16pm

HT used it/TC's seppuku
In the HT document dump there's a TC volume. So HT obviously trusted it.

That was a rather poor write up on the end history of TC, Tim. Actually, that's an understatment, but I'll just leave it at that.

Most educated people came to the conclusion that the wierd, 'canary' like message from TC's anon dev, which included the conspicuous phrase "Not Secure As", along with the completely absurd bitlocker suggestion (amoung others), was indicative of mounting advasarial pressure, and a potential/probable future compromise. If anything it gave us more reason to trust TC. A strong case can be made that the devs words/actions where a form of digital seppuku, and very clever speech under some duress.

As others have mentioned, TC has now been fully audited and found to be without any serious flaws. I hope veracrypt will be (is being?) given the same treatment- until then I'll stick with the original.
[ link to this | view in thread ]
Anonymous Coward, 10 Jul 2015 @ 10:45pm

I still wonder why the TrueCrypt developers decided to suddenly stop maintaining their encryption software. The timing of them closing up shop shortly after the audit announcement is beyond coincidence.

I personally believe the auditors somehow offended the TrueCrypt developers. Maybe something was said that rubbed them the wrong way. I think the TrueCrypt developers decided it's not worth their time and effort to continue maintaining software for a bunch of ungrateful people who keeps insulting them.

Maybe they just decided they have better, more fun, things to do with their free time. I don't blame them.
[ link to this | view in thread ]
Anonymous Coward, 11 Jul 2015 @ 2:45pm

Uh what? I actually re-installed the last working version on my linux partition. Because the audit team has had 2 phases of its audit (or w/e, not an expert). All I know is that things had changed from step 1 showing no holes, step 2 memo saying no danger found yet.

I'd find links but i'm a very lazy dopped up to my eyes on Demerol because of an open fracture of the foot.
[ link to this | view in thread ]
Anonymous Coward, 11 Jul 2015 @ 2:46pm

Re:
What?
[ link to this | view in thread ]
Anonymous Coward, 12 Jul 2015 @ 11:06am

Re: Re:
Oh come on. It makes perfect sense. Why else would the Truecrypt developers totally take down the website and all documentation on Truecrypt. They basically nuked the whole project in a day.

Doesn't that seem like an emotion reaction to you and like sticking one's middle finger at the auditors?
[ link to this | view in thread ]
Anonymous Coward, 2 Aug 2015 @ 8:19am

Reasonable Suspicion versus Reactive Stupidity
I'm prepared to dive into the juiciest government conspiracy theory as much as the next guy, but going paranoiac because the FBI refused to provide you copyrighted documents is a tad unreasonable. The documents were copyrighted, the FBI did not have the right to distribute them.

The FBI referenced the articles. You found them. That the FBI didn't violate the authors' or publishers' copyrights by serving them up to you, for copying costs, on a platter doesn't appear to (reasonably) point to some sinister intent.

Let's not dilute the valid indications of bad acts by government by getting hysterical about the reasonable, and lawful, acts.
[ link to this | view in thread ]
Anonymous Coward, 20 Oct 2018 @ 3:52am

Re:
Here's a theory (some parts of this were read on other websites):

The NSA, seeing that TrueCrypt was undergoing an audit with very good results that would drive more people to use it, decided that they needed to make a move.

The developers were located and were being pressured to hand over their signing keys so the software can be covertly backdoored or weakened.

The developers, not wanting this to happen, handed over the keys to avoid repercussions but also put up their special message, effectively ending the project (NSA trying to start it back up again/pretend the website was defaced would be met with intense scrutiny).
[ link to this | view in thread ]