Is William Barr's Latest Attack On Section 230 Simply An Effort To Harm Tech Companies For Blocking His Desire To Kill Encryption?

from the this-makes-no-sense dept

Last month, we noted that Attorney General William Barr was making a bizarre attack on Section 230 of the Communications Decency Act, claiming that the DOJ was "studying Section 230 and its scope" and arguing -- without evidence -- that 230 might be contributing to "unlawful behavior" online. As we noted at the time, Section 230 explicitly exempts federal criminal charges from what it applies to, meaning that it literally cannot interfere with any DOJ prosecution. So it's truly bizarre to see the DOJ concerned about the issue.

But Barr has continued to push forward with this anti-230 kick, and is going to host a "workshop" about 230 in a few weeks.

The U.S. Justice Department is hosting a workshop next month seeking “a wide diversity of viewpoints” on Section 230 of the Communications Decency Act, the federal statute that, with few exceptions, protections major internet companies and private website owners from liability when it comes to the posts and comments generated by users.

While the DOJ claims that this workshop will have that "diversity of viewpoints," as we've seen in other contexts with the DOJ, that this is rarely the actual case. It may offer up a sacrificial lamb in support of 230, but it is likely to stack the deck against 230. This is the same thing that the DOJ has done, repeatedly, with regard to the encryption debate and questions around "going dark." Indeed, we've noted before the similarities between the government's efforts to attack encryption and the playbook that was used to attack Section 230 in 2018. In fact, we've heard that the very same former Hollywood lobbyist is a key player in both efforts.

Given the similarities in the playbook, and the fact that the DOJ is not hindered at all by 230, it makes you wonder if Barr and the DOJ are playing this anti-230 card simply as a method of punishing the internet industry for opposing his desire to gut encryption? The whole thing seems to be little more than an abuse of DOJ power to intimidate and threaten an entire industry for daring to support online security and free speech online against a government which would prefer neither thing be enabled.

Filed Under: cda 230, doj, encryption, section 230, william barr

Cy Vance Is So Sure Encryption Is Pure Evil He Thinks Over-The-Air Software Updates Are Just Encryption Backdoors Apple Won't Tell Him About

from the of-all-the-things-even,-this-one-i-can't-the-most dept

Manhattan DA Cyrus Vance is back on his anti-encryption bullshit. A Fast Company profile of his "$10 million cyber lab" for decrypting phones contains some really choice quotes from the DA -- quotes that show he's about as on top of all things "cyber" as former NYC mayor/alleged tweet hackee Rudy Giuliani.

The thrust of the piece is that breaking encryption is time-consuming and expensive. Hey, no one's arguing otherwise. But the arguments made by Vance and other law enforcement officials in the article are disingenuous and… well… stupid.

Breaking encryption doesn't scale. Sorry about that, LEOs. That's a fact you're all going to have to come to terms with. But it's not impossible and there are more than a few companies offering to do the dirty work for cyber-strapped agencies that don't have $10 million on hand to bootstrap their own brute forcing.

We're also living in the golden age of surveillance, despite the arguments of a few candle bearers primarily interested in wandering around in the dark cursing. Almost everyone carries a tracking device with them wherever they go. Voluntarily. Reams of data are generated every day, a lot of which doesn't even require a warrant to access. Cops are solving crimes using consumer DNA services, Apple wearables, and always-on smart devices that eavesdrop on conversations law enforcement normally wouldn't have access to.

But let's start with some numbers. I'm beginning to think the Manhattan DA's office is no better at counting locked devices than the FBI is. As you may recall, the FBI spent a few years claiming it was sitting on an exponentially-increasing amount of encrypted devices… right up until it was forced to admit its counting software couldn't count and it had severely overstated the amount of devices in its possession.

The same thing appears to be happening at the DA's office. An increase like this is inexplicable. Here's how many devices Cy Vance was complaining about in 2016:

Manhattan District Attorney Cyrus R. Vance Jr. said at a news conference that investigators cannot access 175 Apple devices sitting in his cybercrime lab because of encryption embedded in the company’s latest operating systems.

And here's what Fast Company is saying in 2020:

On the day I visited the cyber lab, there were nearly 3,000 phones, most related to active criminal investigations, that Moran had not yet been able to access.

Even given Android's dominance in the market, this seems like an incredibly dramatic increase over the past four years. And it seems even less likely given the fact that multiple vendors are capable of cracking older iPhones and Androids, if not the latest models (for now). Rolling your own decryption doesn't seem like the most efficient use of resources, especially when time is of the essence, as Vance claims.

"If we seize a phone that is iOS 10 but can’t open the phone, maybe never, but, say, not for another two years, well, that’s not the timeframe in which cases move, particularly cases when they’re in court."

Plea bargains are the norm, not trials. Even if we discount that depressing fact, pre-trial detention in New York City for felony charges is ~80 days. That's people being locked up before they've even had their day in court (not counting arraignment). Even if Vance wasn't pretending the city isn't willing to lock people up indefinitely while his office pokes away at their phones, the fact remains his office could look to outside help to shorten the process. But it doesn't. And the article (and Vance himself) never explains why.

Let's move on to Vance and his incredible quotes. Behold the man so clearly convinced that device encryption is solely a middle finger extended to law enforcement, he actually seems to believe over-the-air software updates are proof Apple is lying about its ability to access the contents of encrypted phones.

Vance is skeptical that Apple doesn’t have a secret backdoor. “They get into my phone all the time because they upgrade my operating systems and they send me messages,” he says.

Just a friendly reminder, New Yorkers: this is an elected position. You don't need to be represented by someone who sounds like an Infowars commenter.

Vance also appears unable to recognize why encryption matters. He claims phone makers used to be super-helpful. Companies like Apple would take a seized phone and return a jump drive full of data and communications a few days later. But that changed after the Snowden leaks revealed widespread, mostly-unchecked domestic and foreign surveillance. Apple and Google didn't immediately respond, but when they did, they made use of their devices safer for everyone. The "everyone" Venn diagram includes a certain number of criminals. But the important thing was doing all they could to protect customers from thieves (something government officials routinely complained about) and malicious hackers.

It wasn't about screwing US law enforcement. It was a reaction to the sheer power of governments (not just the United States government) to compromise devices and intercept data and communications.

Vance continues to take this personally. And in doing so, he's developed a lot of blind spots. Here's Vance stating he doesn't think US tech companies should be able to decide what's best for their customers.

In the end, Vance just wants prosecutors to have all the tools available to do their jobs. “You entrust us with this responsibility to protect the public,” he says. “At the same time, they”—Apple and Google— “have taken away one of our best sources of information. Just because they say so. It’s not that some third party has decided, this is the right thing for Apple and Google to do. They just have done it.”

So… third parties -- Google, Apple, etc. -- have not decided this. Other third parties (I guess the government?) should make this call. I mean, we know that's what Vance thinks. But this statement makes zero sense. If companies shouldn't be allowed to protect their customers from threats, who should be doing this? The government? Because I think if the lawmakers in Washington crafted a law designed to protect cellphone users, they'd come to the same conclusion -- encryption works -- even if it made things a little more difficult for law enforcement.

Let's not forget the government is operating on power granted to it by the governed, not the other way around. If there's been a slight decrease in evidentiary uptake since the spread of default encryption, so be it. Very few Americans are willing to trade their device security for incremental law enforcement gains, no matter how many law enforcement officials believe citizens are too stupid to know what's good for them.

Not all communications belong to law enforcement, warrant or not. Since the beginning of criminal time, people engaged in illegal behavior have taken steps to reduce their exposure. Front businesses. Cranking up radios/TVs so conversations won't be picked up by bugs. Off-the-grid, face-to-face meetings. And so on. To pretend phones are taking criminals to the next level ignores everything about criminal activity. Smart criminals play it smart. Dumb criminals are still dumb. Compelled decryption is still an unsettled issue, which means cops can roll the dice on court-ordered coercion. Fingerprints, faces, and irises can still unlock phones without much resistance, especially if one of the suspects is dead.

To call Vance's anti-encryption disingenuous would strip that word of most of its power. Vance has an encryption problem. Maybe. But he doesn't have an evidence problem. And he's not making the most of what's available to him, possibly deliberately. I'm sure he'd prefer an encryption ban or court precedent that makes compelled decryption legal. He probably will see neither of these in his lifetime. But until he's out of office, he's going to continue making incoherent complaints. The least publications covering his so-called plight could do is greet him with the skepticism he deserves.

Filed Under: cy vance, encryption, going dark, iphones, over the air updates
Companies: apple

Attorney General Barr's Anti-Encryption Efforts Aren't Supported By Many FBI Officials

from the going-to-war-with-the-one-many-army-you-have dept

When Attorney General William Barr speaks, he represents the DOJ and all the agencies it oversees. The problem is that Bill Barr's recent anti-encryption agitating doesn't reflect the views of the people he oversees. While Barr is trying to turn the public against Apple by suggesting it protects terrorists and murderers, FBI employees are worried his words and actions will harm them more than help them.

The Wall Street Journal spoke to people in the FBI and DOJ who aren't convinced Barr's doing the right thing by taking a hardline stance on encryption. [Non-paywalled version here.]

Some senior FBI officials say privately they are worried that Mr. Barr’s sharp tone could undermine relationships with technology companies they have worked hard to develop, people familiar with the matter said.

The bureau relies on close partnerships with tech firms in a range of investigations, with companies complying with legal requests for data and troubleshooting technical obstacles that agents may struggle with, current and former officials said.

Pushing Apple is unproductive. It damages relationships while gaining absolutely nothing for the DOJ and FBI. Apple has already given the FBI all the information it can pull from the Pensacola shooters' accounts. Breaking encryption simply isn't an option -- not when it leads directly to reduced security for the rest of Apple's customers.

Many in the FBI realize this. Barr just doesn't seem to care. If Barr continues to push his anti-encryption agenda, he not only risks reducing cooperation from tech companies but also the trust of the people who work for him. Barr says Apple's not doing enough to help investigations. Internally, the FBI disagrees.

Some FBI officials were stunned by Mr. Barr’s rebuke of Apple, the people familiar with the matter said, and believe the Pensacola case is the wrong one to press in the encryption fight, in part because they believed Apple had already provided ample assistance to the probe.

Barr's ultimate goal may be another courtroom showdown. Others in the FBI would prefer precedent to outside help from phone-cracking companies. Barr has aligned himself with those officials. But the ones pushing for precedent seem unaware of how much collateral damage the FBI itself might suffer if things don't work out the way Barr wants them to.

[Former DHS Secretary Michael] Chertoff said a court ruling against the Justice Department could limit access to widely available forensic tools that allow investigators to get into phones in some situations, for instance. “It’s not clear to me why this fight is advantageous to anybody,” he said.

Barr and those like them so firmly believe they're in the right, they're seemingly incapable of considering the negative consequences of their actions. Precedent that safeguards people's phones against encryption-breaking efforts works against the government, restricting its access to outside assistance. But even if the FBI gets the precedent it wants, the nation as a whole will be less secure because encryption will be compromised severely and permanently. Barr and his anti-encryption buddies are willing to sacrifice everyone else's security for their own ends. That's not just selfish. It's also dangerous.

Filed Under: doj, encryption, fbi, going dark, william barr
Companies: apple

The FBI Can Get Into The Latest IPhones, So Why Is It Asking Apple To Break Encryption On Older Models?

from the reminder:-the-FBI-still-hasn't-updated-its-locked-device-count dept

The FBI has asked Apple to break the encryption on devices owned by the Pensacola Naval Base shooter. It hasn't made this request officially -- there's no court order being sought to compel Apple's assistance -- but it's asking nonetheless.

Attorney General Bill Barr put a little more muscle behind the FBI's informal request. His statement insinuated that Apple was making the country less safe by refusing to break encryption. He also stated that time was of the essence in cases like this and Apple's general unhelpfulness wasn't acceptable.

Apple fired back by again stating it would not break phone encryption for the US government. It also pointed out the FBI did not inform of it a second locked device until a month after the shooting. If the government was concerned about time slipping away, it did not act with alacrity during this latest investigation.

Donald Trump followed Bill Barr's lead, attacking Apple via Twitter with a particularly stupid tweet that suggests the president is still all about quid pro quo.

The administration is trying to turn public opinion against Apple. This will make it easier to push anti-encryption laws and policies. But the FBI doesn't seem to need Apple to break encryption for it. It has options it's apparently decided not to use in this case.

As we've noted earlier, a handful of tech companies offer devices that break or bypass encryption to pull data and communications from locked phones. Yes, it's still an arms race, with companies like Apple patching the flaws these tools exploit, but there's plenty of money to be made cracking open devices for government agencies.

The FBI isn't interested in these tools, except when it's convenient for the agency. Legal precedent compelling phone manufacturers to break encryption is infinitely more useful to the FBI. So, it chooses to ignore these options when it thinks it has a compelling case for encryption backdoors. That's what appears to be happening here.

Thomas Brewster of Forbes says the FBI has used third-party hacking tools to access the contents of Apple's latest iPhone.

Last year, FBI investigators in Ohio used a hacking device called a GrayKey to draw data from the latest Apple model, the iPhone 11 Pro Max. The phone belonged to Baris Ali Koch, who was accused of helping his convicted brother flee the country by providing him with his own ID documents and lying to the police.

If the FBI can get into the newest devices, why does it need Apple to break encryption on the shooters' phones, which are much older?

Given the models in the Pensacola shooting case are iPhones 5 and 7, it’s unclear why a GrayKey hasn’t proven useful in that investigation. Forbes has previously revealed a GrayKey brochure that showed it worked on older devices, too.

It's a question the DOJ probably doesn't want to answer. It will have to, though. Senator Ron Wyden has already asked the DOJ to explain its actions in this case.

The most obvious answer is this: this case pushes all the buttons the administration wants pressed. It involves the shooting of US military members by a foreigner. The San Bernardino shooting was pretty much the same thing: the shooting of government employees by foreigners. These are the only two cases where the FBI has gone public about its desire to force Apple to undermine its own encryption. For everything else, there are third-party hacking tools that actually give the FBI the evidence it wants without undermining the security of millions of iPhone users.

The FBI will only push for precedent when it thinks it has the public's support. It failed to read the room during the San Bernardino case. It hasn't gotten any better at gauging public opinion since then. Even with Barr and Trump going on the attack, the public's mood hasn't shifted. Compelled encryption-breaking makes everyone less secure, not just the targets of investigations. Trying to parlay dead people's phones into court precedent is not a good look for the agency. But the agency -- and the administration running it -- don't particularly care what the public wants or is best for it.

Filed Under: chris wray, doj, encryption, fbi, going dark, graykey, pensacola, technology, william barr

New Report Says Apple Dropped Plans To Fully Encrypt Backups After FBI Complained

from the encrypt-all-the-things dept

As Attorney General William Barr and other law enforcement officials continue to insist (falsely) that Apple refuses to cooperate with them in undermining encryption and security on all iPhones, plenty of people have been pointing out for years that the reality is that most iPhone encryption is effectively meaningless, because if a user has iCloud backups on, Apple retains the key to that data and can (and does!) open it up for legitimate law enforcement requests. In other words, it's extremely rare that full device encryption actually keeps law enforcement out (and that leaves aside the fact that technological solutions exist for law enforcement to hack into most iPhones anyway). Indeed. as you might recall, during the FBI's last big fight about encryption with Apple, over San Bernardino shooter Syed Farook's iPhone, it was revealed that the FBI's own incompetence resulted in Farook's backups being wiped out before the FBI had a chance to access them.

For quite some time now, EFF and others have urged Apple to close this loophole and allow for truly encrypted iCloud backups, such that even Apple can't get in. Apple has toyed with the idea, but as Tim Cook has said a few times, the company chose not to do it this way after weighing the pros and cons from a user's perspective. The key issue: if something is fully encrypted and Apple doesn't have the key, if you lose your password, the data is effectively gone. There is no "password reset" if Apple doesn't retain the key:

There our users have a key and we have one. We do this because some users lose or forget their key and then expect help from us to get their data back.

However, in that same interview, Cook did suggest that Apple would move towards encrypting backups as well:

It is difficult to estimate when we will change this practice. But I think that will be regulated in the future as with the devices. So we will not have a key for it in the future.

I think that there are legitimate user-centric reasons for the decision that Apple made, though it seems clear that many, many people don't realize that Apple still has the key to their backups. However, a new report from Reuters says that Apple killed plans to offer fully encrypted backups after the FBI got upset about it:

Apple Inc dropped plans to let iPhone users fully encrypt backups of their devices in the company’s iCloud service after the FBI complained that the move would harm investigations, six sources familiar with the matter told Reuters.

The tech giant’s reversal, about two years ago, has not previously been reported. It shows how much Apple has been willing to help U.S. law enforcement and intelligence agencies, despite taking a harder line in high-profile legal disputes with the government and casting itself as a defender of its customers’ information.

At the very least, this shows (yet again) that Barr and other law enforcement officials are blatantly lying when they say that Apple does not cooperate with law enforcement or that it doesn't take the concerns they raise seriously. On the flip side, it is a bad look for Apple, in that it has chosen to avoid a more secure option for its users' data, going against the company's long-standing public support for encryption and protecting users' data.

Again, even if there is a legitimate reason for not encrypting backups -- and it's equally true that if Apple did offer it, there would be public complaints of people no longer having access to their data -- it's troubling that Apple won't even make this an option (with clear warning statements) for end users, and that they're doing so because of blatant fearmongering by law enforcement officials.

Of course, the other way one might look at this decision is that if Apple had gone forward with fully encrypting backups, then the DOJ, FBI and other law enforcement would have gone even more ballistic in demanding a regulatory approach that blocks pretty much all real encryption. If you buy that argument, then failing to encrypt backups is a bit of appeasement. Of course, with Barr's recent attacks on device encryption, it seems reasonable to argue that this "compromise" isn't enough (and, frankly, probably would never be enough) for authoritarian law enforcement folks like Barr, and thus, it's silly for Apple to even bother to try to appease them in such a manner.

Indeed, all of this seems like an argument for why Apple should actually cooperate less with law enforcement, rather than more, as the administration keeps asking. Because even when Apple tries to work with law enforcement, it gets attacked as if it has done nothing. It seems like the only reasonable move at this point is to argue that the DOJ is a hostile actor, and Apple should act accordingly.

Filed Under: backups, doj, encryption, fbi, going dark, icloud, pressure
Companies: apple

Dear Reuters: This Is NOT How You Report On Dishonest, Disingenuous Talking Points From US Officials Regarding Encryption

from the come-on-guys dept

Attorney General William Barr and his DOJ and FBI have really ramped up their bullshit campaign against the public being able to use encryption. President Trump himself weighed in himself with some ignorant statements, suggesting that Apple owes him some sort of quid pro quo, because his policies may have helped them on trade:

We are helping Apple all of the time on TRADE and so many other issues, and yet they refuse to unlock phones used by killers, drug dealers and other violent criminal elements. They will have to step up to the plate and help our great Country, NOW!

This is dumb and wrong for many, many reasons. First of all, no matter what the US government has done on an unrelated issue, that doesn't mean that Apple should do something on a totally different issue. Second, the issue is not Apple "refusing to unlock phones used by killers, drug dealers and other violent criminal elements." It's Apple offering encryption that protects all of us. It is not possible for Apple to "unlock" the phones of criminals without doing so for everyone else as well, putting everyone's information at tremendous risk. And, for very little benefit, seeing as there are multiple private companies who have figure out how to crack iPhone encryption and which the DOJ and other law enforcement agencies are already using.

Indeed, outside of the President and the DOJ, other parts of the federal government have come down against having Apple break encryption, including the intelligence community and the Defense Department who recently told Congress how important general purpose consumer encryption is in protecting national security.

But, because only the other side of the debate seems to get any attention, and because Trump toady's feel the need to kiss up to the President, now we have Treasury Secretary Steve Mnuchin, also repeating nonsense about Apple and encryption:

“I understand the president’s view, and it is absolutely critical for our technology companies to cooperate with law enforcement,” Mnuchin told CNBC in an interview.

Mnuchin later told reporters at the White House that he had not discussed the issue with Apple and did not know the specifics at hand. “I know Apple has cooperated in the past on law enforcement issues, and I expect they would continue ... to cooperate.”

Damn straight he doesn't "understand the specifics at hand." Still, political grifters spewing nonsense is nothing new. What frustrates me is how Reuters framed this story. Its headline blared: "Mnuchin urges Apple, other technology companies to work with U.S. law enforcement"

That's really bad framing, because it suggests to basically everyone (totally incorrectly) that the issue here is that Apple and other tech companies are somehow not "working with U.S. law enforcement." Except they are. Where possible and where reasonable and allowed by law. The issue at play when it comes to encryption literally has absolutely nothing to do with whether or not tech companies should or should not "work with" law enforcement, but rather whether they should put all of our security at risk, in order to make it marginally easier in a few limited cases for law enforcement to get into phones it probably already has access to through other means.

When framed that way, it's obviously dumb. But anyone reading Reuters' coverage of the issue won't get that. They'll think that Apple is somehow taking some sort of stand against US law enforcement. This is what Trump, Barr, and apparently Mnuchin, would like people to think, but it's not true, and it's fundamentally bad journalism for Reuters to frame it that way.

Filed Under: doj, donald trump, encryption, going dark, law enforcement, security, steve mnuchin, william barr
Companies: apple, reuters

Bill Barr: Apple Is Holding Up This Investigation. Apple: You Waited A Month To Tell Us You Needed More Help

from the STFU-and-GTFO-Bill dept

Last week, the DOJ's counsel sent a letter to Apple asking for its assistance cracking open two phones recovered from the shooter at the Pensacola Naval Air Base. Apple replied it had already provided assistance by giving the FBI everything it could recover from the shooter's Apple accounts. The company also made it clear it would not attempt to break the encryption on the phones.

This sounded like a warning shot from the DOJ -- one issued before the commencement of litigation. No formal request for assistance has been made in court yet, but the head of the DOJ has decided to apply additional pressure. Attorney General William Barr's view appears to be that if the FBI has a warrant, Apple has to let it come in. Otherwise, bad things will happen. He also accused Apple of not being helpful enough.

“This situation perfectly illustrates why it is critical that the public be able to get access to digital evidence,” Mr. Barr said, calling on technology companies to find a solution and complaining that Apple had provided no “substantive assistance.”

Going beyond that, Barr said lives are on the line and tech companies unwilling to punch holes in the encryption they use to protect their customers are just adding to the body count.

“We don’t want to get into a world where we have to spend months and even years exhausting efforts when lives are in the balance,” he said. “We should be able to get in when we have a warrant that establishes that criminal activity is underway.”

When time is of the essence, the FBI is only weeks away.

We responded to each request promptly, often within hours, sharing information with FBI offices in Jacksonville, Pensacola and New York. The queries resulted in many gigabytes of information that we turned over to investigators. In every instance, we responded with all of the information that we had.

The FBI only notified us on January 6th that they needed additional assistance — a month after the attack occurred. Only then did we learn about the existence of a second iPhone associated with the investigation and the FBI's inability to access either iPhone. It was not until January 8th that we received a subpoena for information related to the second iPhone, which we responded to within hours. Early outreach is critical to accessing information and finding additional options.

That's from Apple's statement on the matter, as reported by Scott Lucas for Buzzfeed. AG Barr is complaining about months and years, and it's the FBI that waited until a month after the shooting to even inform Apple there was a second iPhone involved.

It could be the DOJ knew Apple would reject its advances. It could also be the FBI was exploring other options during the last 30 days. Even if this is the case, it's completely disingenuous for Bill Barr to give the impression Apple has been uncooperative and is holding up this investigation. Apple helped immediately and turned over "many gigabytes" of data and communications to the FBI.

Just because the feds can't unlock the phones does not mean Apple isn't helping. It just won't do the one thing the FBI wants it to do: weaken a security measure that keeps millions of iPhone users, who've never committed a crime, safe. Apple's statement drives this point home.

We have always maintained there is no such thing as a backdoor just for the good guys. Backdoors can also be exploited by those who threaten our national security and the data security of our customers. Today, law enforcement has access to more data than ever before in history, so Americans do not have to choose between weakening encryption and solving investigations. We feel strongly encryption is vital to protecting our country and our users' data.

If Barr is serious about the safety and security of the nation he's sworn to protect, he'll leave encryption the fuck alone. But Barr isn't serious about this. He wants the DOJ to get what he wants, no matter how much collateral damage it causes. Sacrificing security for minimal gains in law enforcement efficiency is the name of the game. Unfortunately, it's a game we all lose if the DOJ gets its way.

Filed Under: doj, emergency, encryption, going dark, iphones, terrorism, william barr
Companies: apple

Attorney General William Barr Says Apple Isn't Doing Enough To Let The DOJ Check Out A Dead Man's Phones

from the give-it-a-rest,-Bill dept

The DOJ has asked somewhat politely for Apple to break the encryption on some iPhones. Last time, the request wasn't so polite. It involved a legal battle that only ended when a third-party cracked the San Bernardino's iPhone for the FBI. Nothing of interest was recovered from that phone.

Another shooting and another dead shooter has brought Apple and the DOJ together again. The DOJ's counsel sent a letter to Apple asking it to break into two phones recovered from the shooter. Apple stated it had already given the DOJ all the information it could recover without actually cracking the devices. This isn't good enough for the DOJ, which believes the possession of a warrant should trump any concerns about creating encryption backdoors.

There's been no demand made in court… yet. But Attorney General Bill Barr -- whose antipathy towards encryption has been stated multiple times -- is trying to apply a little more extrajudicial pressure.

Attorney General William P. Barr declared on Monday that a deadly shooting last month at a naval air station in Pensacola, Fla., was an act of terrorism, and he asked Apple in an unusually high-profile request to provide access to two phones used by the gunman.

[...]

“This situation perfectly illustrates why it is critical that the public be able to get access to digital evidence,” Mr. Barr said, calling on technology companies to find a solution and complaining that Apple had provided no “substantive assistance.”

It actually illustrates nothing of the sort. "Substantive evidence" is unlikely to be found on the shooter's phones. While the DOJ has pointed to evidence the shooter was "radicalized" on social media, it can only speculate about what evidence can be recovered from the phones, one of which partially destroyed by a deputy's bullet during the shootout with the gunman.

The DOJ's assertions undercut Bill Barr's claims that Apple has provided "no substantive assistance." Barr said that the evidence the DOJ already has shows the "shooter was motivated by jihadist ideology." This is based on social media messages and other content recovered by the DOJ, some of it likely from Apple itself.

There's not much of a case to be built against a dead man. And there's probably some value in mining contacts and text messages, but it's dubious to claim the evidence that might reside on the locked devices will be a game changer for the FBI or result in new leads that could prevent future shootings.

Nevertheless, the Attorney General insists Apple is preventing law enforcement from doing its job. According to Barr, a warrant is all anyone should need to see to start cracking open cellphones for the FBI.

Mr. Barr indicated that he is ready for a sharp fight. “We don’t want to get into a world where we have to spend months and even years exhausting efforts when lives are in the balance,” he said. “We should be able to get in when we have a warrant that establishes that criminal activity is underway.”

This is the leverage. Any tragedy with an iPhone in the mix is fodder for the DOJ's anti-encryption efforts. Third-party services can help the FBI achieve what Barr says it wants to achieve: speedy recovery of evidence from locked devices. But Barr and the agencies he represents only want outside help from the courts -- precedent that will make all cellphone users less safe in the name of securing the nation.

Filed Under: doj, encryption, fbi, going dark, iphones, terrorism, william barr
Companies: apple

San Bernardino 2.0: FBI Asking Apple To Crack Encryption On Phones Owned By Pensacola Naval Station Gunman

from the encryption-is-letting-dead-men-get-away-with-crimes-they-already-committed dept

It looks like the FBI wants to relitigate the San Bernardino shooting. After that tragedy, the FBI tried (and failed) to obtain legal precedent forcing cellphone manufacturers to crack open seized phones at the drop of a warrant. Finally, a third party sold a solution to the FBI that opened the phone and allowed it to recover nothing useful whatsoever from the shooter's device.

The FBI was displeased that it didn't get this precedent. Internal communications showed FBI officials were doing everything they could to avoid using a third-party solution. The theoretical existence of evidence related to a tragic shooting was the only leverage the FBI had and a private company's cracking service took that leverage away. It could no longer claim approaching Apple directly was the only way to access the contents of the phone.

The FBI is trying again. It has more locked phones and another shooting to use as leverage.

The FBI is asking Apple Inc. to help unlock two iPhones that investigators think were owned by Mohammed Saeed Alshamrani, the man believed to have carried out the shooting attack that killed three people last month at Naval Air Station Pensacola, Florida.

In a letter sent late Monday to Apple's general counsel, the FBI said that although it has court permission to search the contents of the phones, both are password-protected. "Investigators are actively engaging in efforts to 'guess' the relevant passcodes but so far have been unsuccessful," it said.

Apple is helping the FBI but it's not doing the only thing the FBI really wants it to do. Apple's statement says it's already turned over "all the data in [Apple's] possession." But it's not going to break the devices' encryption.

And no matter what legal precedent the DOJ obtains -- should it decide to force the issue by seeking a court order compelling decryption -- it still may not find anything useful, or indeed anything at all, if it manages to unlock the devices. There's a twist in this case that sets it apart from the San Bernardino shooting.

A law enforcement official said there's an additional problem with one of the iPhones thought to belong to Alshamrani, who was killed by a deputy during the attack: He apparently fired a round into the phone, further complicating efforts to unlock it.

Shooting someone right in the evidence is a new logistical hurdle -- one that probably can't be cleared with a stack of legal paperwork and precedent. But this is the FBI's latest attempt to undermine device encryption. Attorney General Bill Barr has made it clear he feels encryption is only good for criminals. If the DOJ decides to take another run at this, it will be less likely to back down even if presented with a third-party solution.

The FBI and DOJ are always on the lookout for another tragedy to use as leverage for anti-encryption precedent. Unfortunately, this country produces more than its share of mass shootings, so the FBI and DOJ will always have plenty to work with.

Filed Under: doj, encryption, fbi, going dark, pensacola
Companies: apple

Michael Hayden Ran The NSA And CIA: Now Warns That Encryption Backdoors Will Harm American Security & Tech Leadership

from the good-for-him dept

There are very few things in life that former NSA and CIA director Michael Hayden and I agree on. For years, he was a leading government champion for trashing the 4th Amendment and conducting widespread surveillance on Americans. He supported the CIA's torture program and (ridiculously) complained that having the US government publicly reckon with that torture program would help terrorists.

But, there is one thing that he and I agree on: putting backdoors into encryption is a horrible, dreadful, terrible idea. He surprised many people by first saying this five years ago, and he's repeated it a bunch since then -- including in a recent Bloomberg piece, entitled: Encryption Backdoors Won't Stop Crime But Will Hurt U.S. Tech. In it, he makes two great points. First, backdooring encryption will make Americans much less safe:

We must also consider how foreign governments could master and exploit built-in encryption vulnerabilities. What would Chinese, Russian and Saudi authorities do with the encrypted-data access that U.S. authorities would compel technology companies to create? How might this affect activists and journalists in those countries? Would U.S. technology companies suffer the fate of some of their Australian counterparts, which saw foreign customers abandon them after Australia passed its own encryption-busting law?

Separately, he points out that backdooring encryption won't even help law enforcement do what it thinks it wants to do with backdoors:

Proposals that law-enforcement agencies be given backdoor access to encrypted data are unlikely to achieve their goals, because even if Congress compels tech firms to comply, it will have no impact on encryption technologies offered by foreign companies or the open-source community. Users will simply migrate to privacy offerings from providers who are not following U.S. mandates.

Indeed, this is the pattern we have seen in Hong Kong over the last six months, where pro-democracy protesters have moved from domestic services to encrypted messaging platforms such as Telegram and Bridgefy, beyond the reach of Chinese authorities. Unless Washington is willing to embrace authoritarian tactics, it is difficult to see how extraordinary-access policies will prevent motivated criminals (and security-minded citizens) from simply adopting uncompromised services from abroad.

None of this is new, but it's at least good to see the former head of various intelligence agencies highlighting these points. At this point, we've seen intelligence agencies highlight the value of encryption, Homeland Security highlight the importance of encryption, the Defense Department highlight the importance of encryption. The only ones still pushing for breaking encryption are a few law enforcement groups and their fans in Congress.

Filed Under: backdoors, encryption, michael hayden