The FBI Says Your TV Is Probably Spying On You

from the watching-you-watching-me dept

Like most of the infamous "internet of things," (IOT) smart TVs are a security and privacy dumpster fire. Numerous set vendors have already been caught hoovering up private conversations or transmitting private user data unencrypted to the cloud. One study in 2017 surmised that around 90% of smart televisions can be hacked remotely, something intelligence agencies, private contractors and other hackers are clearly eager to take full advantage of.

This week, the FBI, that bastion of sage privacy and security advice, issued a blog post out of its Portland field office warning cyber Monday shoppers that their smart TV is a little too smart, and likely watches you as much as you watch it. The post is filled with some handy tips to help you protect your privacy:

"Know exactly what features your TV has and how to control those features. Do a basic Internet search with your model number and the words “microphone,” “camera,” and “privacy.”

Don’t depend on the default security settings. Change passwords if you can – and know how to turn off the microphones, cameras, and collection of personal information if possible. If you can’t turn them off, consider whether you are willing to take the risk of buying that model or using that service.

If you can’t turn off a camera but want to, a simple piece of black tape over the camera eye is a back-to-basics option.

Check the manufacturer’s ability to update your device with security patches. Can they do this? Have they done it in the past?

Check the privacy policy for the TV manufacturer and the streaming services you use. Confirm what data they collect, how they store that data, and what they do with it."

Granted such tips don't really do much to fix a broken sector where privacy and security remains an afterthought. A Consumer Reports study from last year found that things aren't really improving in the space. Government hasn't done much to pass any meaningful privacy law for the internet era. Gadget obsessed consumers are historically oblivious or apathetic to the problem. And product makers are too busy worrying about margins and the next big product launch to spend money to upgrade past sets or improve their privacy and security practices (at least not until there's another major scandal).

And if you've shopped for a TV recently, you may have noticed that it's largely impossible to just buy a "dumb" TV set without all of the "smart" internals. More specifically, most TV vendors don't want to sell you a bare-bones set because they want you to use their streaming services. Even more specifically, they want you to buy their sets with their specific streaming functionality because they want to spy on you and monetize your usage data.

So yeah, the FBI's tips are great and all, but they don't really get to the root of the market dysfunction that's plaguing the IOT space. There are plenty of fractured entities trying to help (like Consumer Reports' efforts to integrate an open source privacy and security standard in hardware reviews, or efforts at Princeton to make it clear what devices are actually doing on the network), but in terms of any kind of cohesive solution to the problem, there's little to nothing on the horizon.

Filed Under: fbi, privacy, smart tv, snooping, spying

Surprising No One, The FBI's Watchdog Says The Agency Is Handling Its Informants Improperly

from the consummate-professionals dept

Confidential informants are only as trustworthy as their law enforcement handlers. The FBI isn't the only agency to have problems with handling confidential human sources (CHSs), but it's one of the more notorious, thanks to its botched handling of James "Whitey" Bulger.

This questionable legacy lives on, as the FBI's Inspector General reports. "Whitey" Bulger is name-checked early on in the report [PDF], setting an appropriately cautionary tone for the rest of the document.

The FBI loves its CHSs. Without them, it can't radicalize random people into arrestable would-be terrorists. Without the assistance of criminals, it apparently can't go after other criminals. While a certain amount of criminal activity is necessary to maintain cover, the FBI doesn't appear to be keeping close tabs on its informants, which isn't going to minimize collateral criminal damage during investigations.

The FBI spends $42 million a year paying CHSs but doesn't seem to care whether that money is being wisely spent. The actual number of informants the FBI employs is redacted, but the IG notes that 20% of these are "long-term," having been used by the FBI for at least five years.

The longevity of CHSs is a concern that the FBI doesn't seem to be concerned about. The longer the FBI uses the same informants, the greater the risk they'll be exposed. But beyond that, there's the problem of familiarity. Every five years, CHSs are supposed to be assigned new handlers in order to prevent agents from becoming too close to their charges. The FBI isn't doing this. In fact, the FBI doesn't appear to track length of service with any accuracy, which means the agency potentially has more "Whitey" Bulgers on its hands: criminals whose close relationship with a single handler allows them to engage in far more criminal activity than guidelines (and human decency) would allow.

According to this report, the FBI's inability to properly track CHSs has led to a backlog of required "enhanced reviews" -- the validation process put in place to ensure proper handling of long-term informants. To make matters worse, the FBI unilaterally decided to remove "long-term" as a potential risk factor for CHSs, allowing these problematic informant-handler relationships to fly under the radar.

The few people performing CHS validations are further restricted by FBI policy. It's almost as though the FBI has decided that what it doesn't know can't hurt it. The limitations prevent reviewers from accessing anything more than one year of files, denies them access to other helpful FBI databases, and discourages them from providing recommendations or drawing conclusions from the limited info they can actually access.

The FBI also has problems with automation. The system does not automatically flag CHSs when they hit the five-year mark. This has to be done manually by the informant's handler. Without this feature, handlers and reviewers are left in the dark about CHS longevity, which further hinders the review process and adds to the backlog the FBI will never catch up to at its current review pace.

The FBI knows this is a problem but continues not to care.

Although the FBI has considered improvements to address the shortcomings, it has not taken corrective action by implementing an automated mechanism in Delta.

This refusal to fix this issue has lead to further failures up the line. Handlers with long-term CHSs are supposed to obtain approval from Special Agents in Charge (SAC) for continued handling of these informants. Since the system doesn't flag long-term informants, SACs are not automatically notified and CHSs continued to be handled by the same agents in direct violation of FBI policy.

The problem becomes exponential once FBI field offices are factored in. CHSs in use at field offices are subject to the same review, but review personnel at FBI HQ appear to believe they are there to grease the wheels, not act as oversight.

Several FBI officials suggested to us that there is a risk that field offices may avoid the selection of certain CHSs for validation review because the field offices may wish to continue using those CHSs despite the presence of particular risk factors. In fact, one of these officials told us that the field offices may be sending "softballs," meaning field offices may be sending CHSs lacking any significant risk factors.

It's not just the field offices. The FBI is actively avoiding documenting negative information about CHSs to subvert the justice system. It's just that simple.

[O]ne Intelligence Analyst told us that he was permitted to recommend a CHS receive a polygraph or operational test to the handling agent by phone by not permitted to document the recommendation in the CHS's validation report. Additionally, multiple FBI officials told us that they believe that field offices do not want negative information documented in a CHS file due to criminal discovery concerns and concerns about the CHS's ability to testify. For example, one FBI official told us that some U.S. Attorney's offices will not use a CHS at trial if there is negative documentation in the CHS's file.

The Inspector General obviously recommends the FBI stop doing this sort of stuff but it's obviously already entrenched in the FBI's culture. Officials recognize field offices are harboring shady CHSs but have done almost nothing about it.

Then there's the infosec part. Confidentiality is key to the handling of confidential human sources. But FBI agents don't appear to care that they're putting their sources at risk by carelessly handling communications. Since no policy specifically forbids the use of government equipment to contact CHSs, many agents simply use their FBI-issued phones. The use of electronic communication methods is discouraged, but simply telling people they shouldn't do something is rarely an effective deterrent.

In addition, the central CHS database is on a shared site that grants access to personnel not involved with handling human sources. This increases the risk to CHSs by eliminating the "confidentiality" of the arrangement. The only thing mitigating this increased risk is the fact that the database is riddled with errors and incomplete information. Incompetence might save the day as CHS files improperly accessed may not contain enough accurate information to expose a confidential source. Win-win, I guess.

That the FBI concurs with all of the OIG's recommendations is hardly heartening. Included in this review are recommendations issued by the OIG six years ago in response to CHS handling issues that occurred in 2006. To date, the FBI has only implemented five of the eleven recommendations from the 2013 report.

It's a mess. And it's a mess the FBI continues to make worse. The underlying problem appears to be the FBI's unwillingness to cut loose informants who might be a liability. The only effort that gets made in these situations is to find some way to work around an already-very permissive system to ensure agents can retain the CHSs. A system that fails to flag risk factors or periodic review periods is the kind of system that allows the FBI to engage in business as usual with just enough plausible deniability to avoid the few accountability tripwires built into the system.

Filed Under: fbi, informants

Judge Says The FBI Can't Keep Refusing To Confirm Or Deny The Existence Of Social Media Monitoring Documents

from the that-thing-we're-all-doing...-we-can't-really-say-we're-doing-it dept

The ACLU is one step closer to obtaining documents detailing the FBI's use of social media monitoring tools. The FBI replied to the ACLU's FOIA request with a Glomar and a denial.

First, it neither confirmed nor denied it had responsive records. Then it said even if it did have some, it still wouldn't release them. According to the FBI, releasing documents about the government's well-known use of social media monitoring software would somehow allow criminals to take a peek at super-secret law enforcement tools. It made these assertions despite the fact it publicly secured contracts for social media monitoring tools.

The ACLU sued. And now, it's obtained at least a partial victory. The court says it's not quite accurate to say the DOJ has already publicly acknowledged use of social media monitoring tools. Citing the ACLU's victory in an FOIA lawsuit over drone strike documents, the court points out the bar to clear first is whether it can be said the DOJ -- not the FBI -- has made it clear it's in the social media monitoring business. From the decision [PDF]:

[ACLU v. CIA] does not suggest that the known use of a technique by one agency creates public knowledge of use by a different agency, unless it is publicly known that the agency’s parent agency utilizes that technique. Here, the FBI’s parent agency is the Department of Justice, and the ACLU presents no evidence that it is publicly known that the Department of Justice utilizes the social media monitoring techniques in question.

But that's not the end of the discussion. The FBI works with several other federal agencies and the documents requested would cover any secondhand use of monitoring tools. So, is it public knowledge other federal agencies engage in social media monitoring?

Given the wide array of evidence indicating (1) that other agencies engage in social media monitoring in the immigration and transportation contexts, and (2) that those agencies cooperate, coordinate, and share information with the FBI, the Court also considers whether such evidence makes it possible to impute, for purposes of applying Exemption 7(E), social media monitoring in the immigration and transportation contexts to the FBI. The ACLU presents extensive evidence that the Department of Homeland Security (“DHS”), U.S. Customs and Border Patrol (“CBP”), U.S. Citizenship and Immigration Services (“USCIS”), Immigration and Customs Enforcement (“ICE”), and the Department of State (“DOS”) engage in social media monitoring.

Following this are six straight pages detailing these agencies and their monitoring programs, all of which have previously been discussed publicly. But that still isn't enough.

[T]he Court finds that the weight of authority suggests that the ACLU cannot seek disclosure of the FBI’s policies based on other agencies having disclosed their own policies, together with acknowledgement that they share information with the FBI.

If this seems to be going the government's way, it actually isn't. The Glomar and the attached exemption don't pair as well as the government would like. The Glomar, at least, is a step too far in the direction of unjustified opacity.

The problem for Defendants is that disclosure of social media surveillance—a well known general technique—would not reveal the specific means of surveillance. Denying a Glomar response would only reveal in general the application of a known technique by the FBI to immigration- or transportation-related investigations. Merely requiring the FBI to answer whether there are documents of the kind requested would not, at this juncture, require the disclosure of those documents which might reveal specific tools and techniques utilized by the FBI.

The government then argued denying a Glomar might expose the FBI's lack of social media monitoring. The court says the FBI can't have its Glomar and its FOIA exemption if it wants to make that argument.

[T]he language of Exemption 7(E) refers only to disclosure of techniques and procedures, and not to the lack of any such technique or procedure, and the Ninth Circuit has limited the application of “risk of circumvention” of the law under Exemption 7(E) to guidelines, not techniques and procedures. Hence, it is not clear whether Defendant’s negative inference argument is cognizable under Exemption 7(E).

In the end, it's the level of perceived harm that gives the ACLU a shot at obtaining these records. The FBI and DOJ claim any release of info would result in criminal mayhem due to criminals suddenly being made aware of the existence of social media monitoring programs. The court says that's just not going to happen.

[T]he risk of criminal activity escaping detection thru social media if the FBI were to reveal it has no records is substantially mitigated by two facts. First, it is well known that many related agencies do engage in social media surveillance in the immigration centers and share that information. This lessens the risk that people will be emboldened by the FBI’s disclosure to spread criminal or terrorist messages through social media. Second, even if the FBI were to disclose it has no records of purchasing or acquiring products or services used to surveil social media, that does not mean that the FBI has no such tools at its disposal, as it could have developed such tools internally.

This kills the FBI's Glomar. It will now have to at least confirm or deny it has records relevant to the ACLU's request. And once it's done that, it can start arguing about whether or not it can use Exemption 7(e) to keep them out of the ACLU's hands. Given the previous paragraph, it's difficult to see how the FBI can possibly justify a refusal to release any of the documents it may (or may not lol) have on hand. Social media monitoring efforts are well-known in the public and private sectors. If the FBI is doing something new and interesting with this, it might have a point. But if it's just doing the same thing other agencies are doing, it really can't justify rejecting this request.

Filed Under: doj, fbi, foia, glomar, social media monitoring, transparency

Interpol Confirms, Denies It's Against Strong Encryption

from the wait-that-sounded-better-before-we-said-it-out-loud dept

The latest law enforcement agency to offer up its opinion on end-to-end encryption doesn't seem to like it either. Joseph Menn reports for Reuters that Interpol is siding with the FBI, DOJ, and a handful of European government agencies in finding that encryption is bad and lets bad people do bad things.

The international police organization Interpol plans to condemn the spread of strong encryption in a statement Monday saying it protects child sex predators, three people briefed on the matter told Reuters.

At the group’s conference in Lyon, France on Friday, an Interpol official said a version of the resolution introduced by the U.S. Federal Bureau of Investigation would be released without a formal vote by representatives of the roughly 60 countries in attendance, the sources said.

This follows the anti-encryption agitating performed by Attorney General William Barr and FBI Director Chris Wray in response to Facebook's announcement it would add end-to-end encryption to its Messenger service, bringing it more in line with Whatsapp, another of Facebook's acquisitions. Both used the specter of child exploitation to argue against this implementation -- an effort to sacrifice the security of millions for some slight gains in law enforcement efficiency.

Sean Gallagher of Ars Technica obtained a draft copy of the resolution, which adds more redundancy to earlier "think of the children" arguments.

The current path towards default end-to-end encryption, with no provision for lawful access, does not allow for the protection of the world’s children from sexual exploitation. Technology providers must act and design their services in a way that protects user privacy, on the one hand, while providing user safety, on the other hand. Failure to allow for Lawful Access on their platforms and products, provides a safe haven to offenders utilizing these to sexually exploit children, and inhibits our global law enforcement efforts to protect children.

Encryption does not "provide safe havens" for child abusers. This is Interpol's version of AG Barr's "lawless spaces" assertions, which doesn't improve at all on Barr's fatuous statements. As former FBI General Counsel Jim Baker recently pointed out, Barr's argument isn't about where the law is being circumvented, but rather about how he doesn't like the way relevant laws work.

So, encryption has not, as the attorney general complained in his speech, really created a “law free zone.” It’s just that the law that applies in this area is not what Barr or the Justice Department want the law to be.

Interpol could not be reached for comment in time for publication but it sure had a lot to say about the issue now that its apparent stance on encryption has been made public. It told the New York Times' Nicole Peroth the Reuters story was inaccurate.

If you can't read/see the tweet, it says:

Dear Ms Perlroth,

As per our statement there are, and were, no plans at this time for the INTERPOL General Secretariat to issue a statement in relation to encryption.

This contradicts statements made by conference attendees, who said Interpol's resolution/statement was "due to be published this week." Perhaps Interpol has undergone some hasty reconsideration after reading its own words on the pages of multiple press sites. Or maybe the timetable is off. All Interpol is really saying is that it won't be issuing this "at this time." This isn't a rejection of these articles' substance. It appears to be nothing more than a dispute about when Interpol will take a public stance against encryption.

Or maybe it has decided to let the 60 representatives from countries Interpol serves actually vote on the resolution. This would be a far better route than issuing a resolution unilaterally declaring opposition to encryption that many members may not actually support.

Whatever the case, Interpol's suggestion that encryption's main beneficiary is international crime is shortsighted and selfish. It's also dangerous. In a world filled with cyberthreats, efforts to undermine encryption "for the good of the public" won't actually result in the public being better served. It certainly won't make them any better protected.

Filed Under: doj, encryption, fbi, going dark, interpol

FBI Asks Congress To Permanently Reauthorize The Phone Record Collection The NSA Voluntarily Shut Down

from the IC's-make-a-wish-foundation dept

Earlier this year, the NSA -- after a few months of hedging -- finally mothballed its phone record collection program. The modified phone metadata collection had posed problems for the NSA since its remodeling with the enactment of the USA Freedom Act, which forced the NSA to ask telcos for specific records, rather than just demanding they hand over everything on a rolling 90-day basis.

Whatever benefits this program provided to the NSA was apparently outweighed by the technical problems it created. After hinting at its impending death on a podcast of all things, the NSA made it (sort of) official in May, saying it didn't see any reason to move forward with the collection, not after it had already been unofficially shut down for several months by that point.

The NSA may not need the phone records collection but it appears the FBI thinks it does. The easiest way for Congress to codify the program's shut down would be to let it expire at the end of this year. FBI Director Chris Wray is hoping to prevent a do-nothing Congress from doing nothing and letting the clock run out on the metadata collection.

Wray's testimony to the Senate Intelligence Community asks legislators to flip the switch back to "ON."

NSA’s decision to suspend the CDR program does not mean that Congress should allow the CDR authority to expire. Rather, that decision shows that the Executive Branch is a responsible steward of the authority Congress afforded it, and that the numerous constraints on the government imposed by the FREEDOM Act, including oversight by the FISC, are demanding and effective. As technology changes, our adversaries’ tradecraft and communications habits continue to evolve and adapt. In light of this dynamic environment, the administration supports reauthorization of the CDR provision so that the Government will retain this potentially valuable tool should it prove useful in the future.

Yeah, I know. He said the NSA is trustworthy. It isn't, of course. And neither is the FBI for that matter. But the FBI feels strongly that the program the NSA can't operate without violating the law might be useful at some point in the future for whatever reason. And the FBI wants this authorization to be permanent, so it doesn't have to come down to the SSCI and make this pitch every half-decade. But "just in case" isn't really a compelling reason to keep a questionable authority alive, much less forever.

It's not the only thing the FBI wants permanently authorized. It wants the rest of the business records collection -- the stuff that isn't phone records (but IS bank records, hotel records, car rental records, apartment lease records, etc.) -- permanently reauthorized. This gives the FBI and other members of the Intelligence Community (which now includes the CBP) warrantless access to a wealth of records our courts and Congresspeople haven't declared worthy of Fourth Amendment protections.

Then there are the roving wiretaps. The FBI wants those reauthorized forever, despite its history of abuse. And it wants to be able to target random people for almost no reason whatsoever with the "lone wolf" provision. Normally, it's only able to target individuals in terrorism-related investigations by showing they're tied to an international terrorist group. With this provision, it can target non-US persons based on the hunch they might be their own personal terrorist cell.

The FBI says it has never used this provision, which seems like a clear indication it's not really needed. Nevertheless, the FBI feels this -- like the phone metadata collection -- might become useful at some undetermined point in the future and wants to keep its options open.

This is why surveillance reform is an ongoing battle, not something that can be patched up here and there with legislation. Every reform effort contains sunset periods and when those appear on the horizon, IC members start petitioning Congress to not only reauthorize powers they're not even using, but to do so permanently so they don't have to ask for another renewal every half-decade or so. Every sunset contains the potential for a "forever" authorization of powers the IC doesn't like to discuss in public and have likely been abused periodically, if not frequently. At minimum, IC members should be forced to justify the continuance of expiring collections and authorizations. If they can't offer something better than the FBI's offering here, the programs should be allowed to fade from existence.

Filed Under: 4th amendment, congress, fbi, mass surveillance, metadata, nsa, phone metadata, section 215, surveillance

FBI's Top Lawyer From The Apple Encryption Fight Says Law Enforcement Needs To Suck It Up And Embrace Encryption

from the didn't-see-that-coming dept

Jim Baker was the FBI's General Counsel during its well-publicized attempt to use the San Bernardino shootings from 2016 as a wedge to force Apple to build a backdoor into its data encryption scheme. As we noted at the time, this seemed like a very clear, somewhat cynical attempt to use a high profile attack as an excuse to force Apple's hand in building back doors. When that battle happened, then FBI director Jim Comey took to the pages of Lawfare to insist that there were good reasons for the FBI to fight with Apple in court to force it to create a backdoor.

Now, Baker has taken to the pages of Lawfare as well to... apparently point out that he and the FBI were totally wrong about all of that and that his former colleagues at the FBI and DOJ need to get it over it and embrace encryption. It's quite a piece.

In the face of congressional inaction, and in light of the magnitude of the threat, it is time for governmental authorities—including law enforcement—to embrace encryption because it is one of the few mechanisms that the United States and its allies can use to more effectively protect themselves from existential cybersecurity threats, particularly from China. This is true even though encryption will impose costs on society, especially victims of other types of crime.

Baker defends his own work on the San Bernardino case, but is now recognizing how dangerous backdoors can be and how important encryption is. He takes current Attorney General William Barr to task for his new anti-encryption propaganda campaign:

The attorney general’s perspective on encryption is far from universal. A range of individuals and groups—including some tech companies, computer scientists, engineers, cybersecurity experts, and privacy and human rights organizations—think that encryption protects both our security and our privacy. See here and here for examples. Well-designed and well-implemented encryption makes it harder for malicious cyber actors to unlawfully hack and steal our communications, personal data and intellectual property. In their view, weakening encryption through the installation of “back doors” on smartphones or in communications systems, or providing law enforcement with “golden keys” to allow them access to encrypted data, jeopardizes all of us. Many would disagree strongly with the attorney general’s assessment that an acceptable technical solution to law enforcement’s problem—one that appropriately balances

all of the equities at issue—actually exists.

Baker even highlights a key point many of us have pointed out in the past. For all the talk of "going dark," law enforcement has more access to information than ever before in history:

Further, the situation for law enforcement may not actually be as bad as some claim. In fact, some argue that society is in a “golden age of surveillance” as substantially more data—especially metadata—than ever before is available for collection and analysis by law enforcement. Finally, critics charge that law enforcement agencies have not provided the public with comprehensive and reliable data to explain exactly how many encrypted devices or communications those agencies encounter as well as the number and type of investigations that encryption negatively impacts.

Indeed, Baker highlights how misleading Barr and others (including Baker's old boss, Comey's) arguments are when they say that encryption leads to a lawless digital space:

So, encryption has not, as the attorney general complained in his speech, really created a “law free zone.” It’s just that the law that applies in this area is not what Barr or the Justice Department want the law to be.

Baker also highlights how undermining encryption puts us all at risk in a wide variety of ways, from basically handing over security services to non-US companies, to putting all our data at risk, to also creating a great opening for countries who wish to do us harm. There are a lot of really great points in this post, way beyond what I'm highlighting here, so I highly recommend reading the whole thing. Indeed, towards the end, Baker (correctly) highlights that protecting our own digital security almost certainly is a better way of protecting Americans than being able to hack into the phones of a few people:

If I’m correct about the existential nature of cyber threats and about the risks that nation-states such as China, in particular, pose to the United States and its allies, then federal, state and local governments should be doing everything they can to enhance the cybersecurity status of the nation. All public safety officials should think of protecting the cybersecurity of the United States as an essential part of their core mission to protect the American people and uphold the Constitution. And they should be doing so even if there will be real and painful costs associated with such a cybersecurity-forward orientation. The stakes are too high and our current cybersecurity situation too grave to adopt a different approach.

A key theme throughout the whole piece is that it's time for law enforcement to accept reality and to stop pretending there's some fantasy "magic bullet" or "golden key" that will allow them to safely backdoor their way into encrypted devices. He admits that this may, sometimes, make law enforcement's job harder, but the benefits for everyone's safety so vastly outweigh that potential downside as to suggest this shouldn't even be much of a debate.

All of this is stuff that many of us who have fought against encryption backdoors have been saying for decades, but it's pretty surprising (to the level of almost shocking) that Baker is now expressing this view -- given his role in literally working to backdoor Apple's encryption. This is not a privacy activist. This is someone who was basically in charge of the FBI's last big effort to have the courts break encryption. Baker insists that his actual views haven't changed very much, though that does seem at least somewhat difficult to square with the FBI's position in the Apple legal fight. But, either way, it's great to see someone of his stature and experience now agreeing that undermining encryption would be very, very dangerous -- and that he's willing to tell his former colleagues, directly, that they, too, should embrace this position.

Filed Under: backdoors, encryption, fbi, going dark, jim baker, law enforcement, san bernardino, william barr

DOJ's Latest Child Porn Site Takedown Shows Encryption Isn't Really Stopping The Feds From Fighting Child Porn

from the welcome-to-basic-detective-work dept

The DOJ just delivered a counterargument to its own anti-encryption rhetoric. Attorney General William Barr, Deputy AG Jeffrey Rosen, and FBI Director Chris Wray recently spent some time decrying the increasing use of encryption to secure personal communications.

The latest attack on encryption was prompted by Facebook's announcement that it would be adding end-to-end encryption to its Messenger service. Three governments (US, UK, Australia) joined forces to tell Facebook it was wrong. They promised Facebook's inability to snoop on its users' messages would allow thousands of child porn producers and consumers to escape justice.

And yet the DOJ, FBI, and others are still managing to track down and arrest criminal suspects -- all without having access to encryption backdoors or compromised communication services. As Jason Koebler reports, another child porn investigation has led to the takedown of a dark web site.

The Department of Justice announced on Wednesday that it has seized and shut down Welcome to Video, one of the world’s largest dark web child porn websites in a worldwide law enforcement action.

Law enforcement has arrested 337 alleged pedophiles in 38 countries around the world and has rescued 23 children from abusive situations as part of the operation, the DOJ said in a press conference on Wednesday.

No backdoors were needed to track down the owner of the server or hundreds of the site's visitors. For that matter, the FBI didn't even need a warrant. The FBI did not deploy its infamous NIT (Network Investigative Technique) to track down site users. The flaw was the payment system linked to the site. Users may have thought their Bitcoin transactions couldn't be traced back to them, but they were wrong.

According to an indictment, law enforcement was able to track users of the site on the blockchain not because of the design of Bitcoin itself, which is pseudonymous, but because “virtual currency exchanges were required by US law to collect identifying information of their customers and verify their clients’ identities.”

Many financial records are third-party records. No warrants needed. Investigators sent Bitcoin to the child porn site's wallet multiple times, managing to suss out the wallet's owner. Somewhat conveniently, the owner's phone number and email account were listed with the exchange. Investigators then began digging up info on other users who were sending Bitcoin to the same wallet, using the mandated data collection to unmask site visitors. Coinbase was handed a subpoena and Coinbase handed over users' info.

The DOJ's overwrought anti-encryption arguments aside, there's another concerning aspect of this investigation -- one the DOJ is far less willing to discuss. As Koebler points out, the DOJ apparently let the site operate for months, if not years, to track down as many site visitors as possible.

The indictment [PDF] indicates investigators were aware of the site's existence since 2015. At some point between then and the operator's arrest in March of 2018, investigators purchased site credits and downloaded child porn. The indictment does not say when the DOJ took control of the site and/or shut it down. It doesn't appear the FBI or any other law enforcement agency continued to run the site after its seizure (as the FBI has done in other cases), but it is disturbing multiple law enforcement agencies felt it was better to leave the site up and running -- and victimize more children in the process -- than shut it down as soon as possible with the understanding some site visitors might escape prosecution.

The facts of this case undermine the DOJ's assertions about the necessity of encryption backdoors to successfully investigate and prosecute child porn producers and distributors. This case even undercuts its arguments about cellphone encryption, as the FBI's testimony [PDF via Cyrus Farivar] shows it didn't have to make any effort at all to access the contents of an arrestee's phone.

Q. Did he have a cellphone on him at the time you encountered him?

A. Yes.

Q. Did you seize that?

A. Yes.

Q. Did he voluntarily provide the password --

A. Yes.

Q. -- passcode to it?

A. Yes.

Encryption isn't the roadblock the DOJ's rhetoric makes it appear to be. It may make some investigations more difficult, but it certainly doesn't make them impossible. The DOJ can still protect children without making communications less secure for millions of people. It's not zero sum. It's a tradeoff -- something the DOJ is familiar with. It trades the continued exploitation of children for a few more prosecutions when it takes on child porn sites. If it's willing to allow children to be hurt to save children, you'd think it would be a bit more cautious when suggesting the public should give up its security in exchange for the DOJ's idea of "public safety."

Filed Under: child porn, doj, encryption, fbi, investigations
Companies: welcome to video

Ed Snowden: Governments Can't Make The Public 'Safer' By Undermining The Encryption Essential To The Public's Security

from the DOES-NOT-COMPUTE dept

With the DOJ uniting with the UK and Australian governments to decry the use of end-to-end encryption by messaging services, it's again time to remind people why encryption matters. The way these government entities see it, encryption mainly helps criminals. Apparently, it's simply not necessary for law-abiding citizens to have secure communications.

This is wrong on many levels, starting with the insistence there's a safe way to circumvent encryption. There isn't. But multiple government agencies claim tech companies are overstating the reality, when all they're actually doing is stating the obvious.

Someone who knows a thing or two about the importance of encrypted communications has written an op-ed for The Guardian. Ed Snowden's article points out why citizens should be alarmed governments are trying to make their personal communications less secure for the children or the greater good or whatever.

For more than half a decade, the vulnerability of our computers and computer networks has been ranked the number one risk in the US Intelligence Community’s Worldwide Threat Assessment – that’s higher than terrorism, higher than war. Your bank balance, the local hospital’s equipment, and the 2020 US presidential election, among many, many other things, all depend on computer safety.

And yet, in the midst of the greatest computer security crisis in history, the US government, along with the governments of the UK and Australia, is attempting to undermine the only method that currently exists for reliably protecting the world’s information: encryption. Should they succeed in their quest to undermine encryption, our public infrastructure and private lives will be rendered permanently unsafe.

Encryption for communications encompasses far more than the idle chatter of social media users. Facebook is the target of the combined force of the US, UK, and Australian governments -- thanks to its plans to add end-to-end encryption to its Messenger service -- but other platforms and services providing encrypted communications will be next on the block if Facebook is deterred from offering this protection. Or worse, talked into creating a backdoor so either it -- or government agencies -- can spy on users' communications.

As Snowden points out, actual infrastructure is at stake. Encrypted communications are vital to the security of plenty of things even governments would like to see remain secure. And yet, they're willing to paint encryption as an accomplice to criminal acts, rather than the vital necessity it actually is.

If Facebook is willing to limit the amount of data it can harvest from its users by locking up Messenger so tight even it can't see the messages, providing encryption must not only be of value to users, but to Facebook itself. This cuts against the DOJ's ridiculous arguments that no one is demanding secure communications -- a statement that insinuates private companies are sticking it to the man just to stick it to the man.

These governments are claiming the introduction of encryption will make it impossible to investigate criminal acts. The one most frequently cited is the production and distribution of child porn. Recent cases make it clear encryption isn't preventing law enforcement agencies from tracking down criminals or shutting down their dark web services. The DOJ and others still have a wealth of investigative tools at their disposal. Private conversations that remain private doesn't change all that much. The history of criminal activity includes millions of conversations law enforcement agencies had no access to, and yet, they still managed to arrest and prosecute criminals.

This isn't about making anyone safer or preventing encrypted services from becoming ad hoc child porn servers. This is about what works easiest and best for governments.

The true explanation for why the US, UK and Australian governments want to do away with end-to-end encryption is less about public safety than it is about power: E2EE gives control to individuals and the devices they use to send, receive and encrypt communications, not to the companies and carriers that route them. This, then, would require government surveillance to become more targeted and methodical, rather than indiscriminate and universal.

The "public safety" argument doesn't make sense. The public doesn't achieve a net "safety" gain when its private communications are compromised. But it makes sense to these governments, which have often considered the rights they promised to respect as inconveniences to be routed around or removed completely.

Filed Under: chris wray, doj, ed snowden, encryption, fbi, going dark, william barr

After Jack Hack, Government Starts Taking Wireless 'SIM Hijacking' Seriously

from the yeah-maybe-get-on-that dept

Wireless carriers have been under fire for failing to protect their users from the practice of SIM hijacking. The practice involves posing as a wireless customer, then fooling a wireless carrier to port the victim's cell phone number right out from underneath them, letting the attacker then pose as the customer to potentially devastating effect. Back in February, a man sued T-Mobile for failing to protect his account after a hacker, pretending to be him, ported out his phone number, then managed to use his identity to steal thousands of dollars worth of cryptocoins.

Like the ongoing wireless industry's location data scandals, the FCC has so far refused to utter so much as modest condemnation of carriers that have failed to protect users.

But with Twitter CEO Jack Dorsey having his Twitter account recently hijacked thanks to SIM hijacking, the government appears to have finally gotten the message that we have a bit of a problem.

For example, the FBI issued a warning last month to its private industry partners, noting that two-factor authentication can be bypassed thanks to the hacks:

"The FBI has observed cyber actors circumventing multi-factor authentication through common social engineering and technical attacks," the FBI wrote in a Private Industry Notification (PIN) sent out on September 17. The FBI made it very clear that its alert should be taken only as a precaution, and not an attack on the efficiency of MFA, which the agency still recommends. The FBI still recommends that companies use MFA.

Carriers, for their part, don't much like to publicly talk about the problem. In part because it's frequently their employees who are helping to facilitate the scams for a little money on the side. Identity thieves use SIM hijacking to do everything from cleaning out bank accounts, to stealing valuable Instagram usernames and selling them for Bitcoin. The process isn't particularly complicated, and more often than not involves the social engineering of a cellular carrier's support employees. Until the Dorsey hack, their refrain has been this is a small problem that's very unique. It's not.

There are some steps users can take, including changing passwords frequently. T-Mobile users can also, for example, call 611 from your cellphone (or 1-800-937-8997), then tell a support staffer that you want to create a “port validation” passcode (here's a guide for other carriers). Still, like the SS7 wireless exploit that has been in the wild for years, it's clear wireless carriers might want to spend a little less time on mindless mergers and consolidation, killing net neutrality, and jacking up prices, and a little more time training their employees and protecting their customers from security threats.

Filed Under: fbi, fcc, identity fraud, jack dorsey, sim hijacking, telcos

FISA Court Finds The FBI Is Still Violating The Fourth Amendment With Its Abuse Of NSA Collections

from the no-surprises-here dept

The NSA isn't the only agency to abuse its surveillance powers. The FBI's ability to access unminimized data harvested by the NSA has resulted in abuse after abuse, as the FBI loves to use the massive data haul to perform "backdoor searches" of its domestic targets.

This concern has been raised repeatedly, most notably by Sen. Ron Wyden, who has been calling out surveillance abuses for years -- specifically calling out these backdoor searches and hinting (strongly) that they are much more prevalent than most people believed. Nothing much has been done about it, other than multiple federal agencies suggesting they too should be put on the ever-growing list of entities with access to the NSA's multiple collections.

A FISA Court opinion released by the Office of the Director of National Intelligence (ODNI) details even more abuse of the NSA's Section 702 collections by the FBI. When you give an agency the power to dig into massive amounts of data with minimal oversight, abuses will happen. But this goes further than "inadvertent" collections or erroneous access of unminimized data. This ruling [PDF] -- first reported on by the Wall Street Journal -- shows the FBI treats sensitive collections as its personal playground.

The October 2018 court ruling identifies improper searches of raw intelligence databases by the bureau in 2017 and 2018 that were deemed problematic in part because of their breadth, which sometimes involved queries related to thousands or tens of thousands of pieces of data, such as emails or telephone numbers. In one case, the ruling suggested, the FBI was using the intelligence information to vet its personnel and cooperating sources. Federal law requires that the database only be searched by the FBI as part of seeking evidence of a crime or for foreign-intelligence information.

In other instances, the court ruled that the database had been improperly used by individuals. In one case, an FBI contractor ran a query of an intelligence database—searching information on himself, other FBI personnel and his relatives, the court revealed.

The partially-redacted, 138-page opinion makes it clear the FBI has frequently abused its access to the NSA's surveillance collections, which include emails, phone numbers, and a host of other digital detritus. Using collections authorized only to be used for national security purposes to perform security reviews of FBI personnel is obviously contrary to the intention of the program -- a purpose that is always reiterated loudly any time someone suggests surveillance should be curtailed. This opinion vindicates Wyden's incessant demands the FBI come clean about its backdoor searches. Wyden argued the FBI abused this power frequently. This opinion makes it clear the FBI abuses its "backdoor" access to domestic data constantly.

The weirdest thing is the Trump DOJ argued in court the program the FBI abused cannot be modified without harming the security of the nation. Yep, the administration that claims the "Deep State" is out to get it showed up in court to argue the Deep State should not have its power curtailed.

The court rejected this faulty premise. It also pointed out how severely any misuse of this power contains the potential to harm dozens, if not thousands, of people. Considering the breadth of the collection, running a single improper search returns hundreds, if not thousands, of records the FBI has no business retrieving. Using the database to vet employees or perform natsec vanity searches does not comply with the restrictions on the FBI's searches, which are only supposed to return data related to criminal activity (and then only certain crimes) and/or foreign intelligence information.

As usual, Sen. Ron Wyden was the first to go on record criticizing the FBI and its backdoor searches following the release of the FISA opinion.

Last year, when Congress reauthorized Section 702 of FISA, it accepted the FBI's outright refusal to account for all its warrantless backdoor searches of Americans. Today's release demonstrates how baseless the FBI's position was and highlights Congress' constitutional obligation to act independently and strengthen the checks and balances on government surveillance. The information released today also reveals serious abuses in the FB's backdoor searches, underscoring the need for the government to seek a warrant before searching through mountains of private data on Americans. Finally, I am concerned that the government has redacted information in these releases that the public deserves to know.

Wyden makes good points. And they're points he's made for years. Unfortunately, the FBI continues to do the stuff it shouldn't and the public has to read between the redactions in an (often vain) attempt to see what's being done to them in the name of "national security."

The abuses will continue until Congress or the FISA Court decide they've seen enough. While both entities have chastised agencies with access to NSA collections, neither have taken any action that will head off future misuse of surveillance databases in the future. We're a reactionary nation when it comes to surveillance abuse and that's just not going to prevent future abuses. But that's the nature of the national security beast. No one's allowed to know what's going on until after everything bad has happened.

Filed Under: 4th amendment, backdoor searches, fbi, fisa court, fisc, nsa, odni, ron wyden, vanity searches