Defense Department To Congress: 'No, Wait, Encryption Is Actually Good; Don't Break It'

from the seems-important dept

As Senate Judiciary Committee Chair Lindsey Graham has continued his latest quest to undermine encryption with a hearing whose sole purpose seemed to be to misleadingly argue that encryption represents a "risk to public safety." The Defense Department has weighed in to say that's ridiculous. As you may recall, the DOJ and the FBI have been working overtime to demonize encryption and pretend -- against nearly all evidence -- that widespread, strong encryption somehow undermines its ability to stop criminals.

However, it appears that other parts of the government are a bit more up to date on these things. Representative Ro Khanna has forwarded a letter to Senator Graham that he received earlier this year from the Defense Department's CIO Dana Deasy, explaining just how important encryption actually is. The letter highlights how DoD employees rely on the kind of strong encryption found on mobile devices and in VPN services to protect the data of their employees, both at rest (on the devices) and in transit (across the network).

All DoD issued unclassified mobile devices are required to be password protected using strong passwords. The Department also requires that data-in-transit, on DoD issued mobile devices, be encrypted (e.g. VPN) to protect DoD information and resources. The importance of strong encryption and VPNs for our mobile workforce is imperative. Last October, the Department outlined its layered cybersecurity approachto protect DoD information and resources, including service men and women, when using mobile communications capabilities.

[....]

As the use of mobile devices continues to expand, it is imperative that innovative security techniques, such as advanced encryption algorithms, are constantly maintained and improved to protect DoD information and resources. The Department believes maintaining a domestic climate for state of the art security and encryption is critical to the protection of our national security.

So, there you have it. The Defense Department believes that strong, unbroken encryption is critical to national security, as opposed to the DOJ which appears to think (incorrectly) that it undermines national security. At the very least, this should mean that politicians should stop uncritically claiming that encryption is some sort of "debate" between privacy and national security. It is not. Encryption protects both of those things. Breaking encryption harms both privacy and national security... in the hopes that it might make law enforcement's job marginally easier.

Filed Under: backdoors, dana deasy, defense department, dod, encryption, lindsey graham, ro khanna

EU Tells US: Ban Strong Encryption, And Privacy Shield Data Sharing Agreement Could Be At Risk

from the question-of-adequacy dept

As a recent post underlines, law enforcement agencies around the world are still trying to argue that things are "going dark", and that strong encryption is bad and should be made illegal. Techdirt and many others have pointed out what an extremely stupid idea this would be. Here's a further reason why the US shouldn't ban strong encryption: it might lead to the EU making data transfers across the Atlantic much harder. The possibility has emerged thanks to some formal questions to the European Commission (pdf) submitted by a Member of the European Parliament, Moritz Körner. They include the following:

According to the news website Politico, the US government is considering a ban on encryption.

1. Would the Commission consider a similar ban in the EU to be useful?

2. Would a ban on encryption in the USA render data transfers to the US illegal in light of the requirement of the EU GDPR for built-in data protection?

The answers from the European Commission have now been published (pdf). The first response is as follows:

Encryption is one of the means of protecting confidentiality as well as privacy and is widely recognised as an essential tool for security and trust in open networks. No ban on encryption is being considered.

That's good, but:

At the same time, the use of encryption should be without prejudice to the powers of competent authorities to protect important public interests in accordance with the procedures, conditions and safeguards set forth by law. In particular, access to communications data by national authorities may be justified in individual cases by the objective of preventing or investigating criminal offences, as long as such measures are necessary, proportionate and respect due process rights.

The boilerplate caveat doesn't say how the EU aims to provide lawful access to communications data when strong encryption is employed, and so doesn't really illuminate EU policy here. By contrast, the response to the second question about the impact a US ban on strong encryption might have does provide new information:

Should the U.S. enact new legislation in this area, the Commission will carefully assess its impact on the adequacy finding for the EU-U.S. Privacy Shield, a framework which the Commission has found to provide a level of data protection that is essentially equivalent to the level of the protection in EU, thus allowing for the transfer of personal data from the EU to participating companies in the U.S. without any further restrictions.

Privacy Shield governs the flow of EU citizens' personal data to the US -- something of vital importance to US Internet companies, and many others. Because of the GDPR's requirements, that flow can only take place if the European Commission issues an "adequacy decision" -- essentially confirming that a country outside the EU offers a sufficient level of data protection. Without adequacy, US companies would be forced to take additional, more onerous measures to guarantee that EU personal data was protected to the level required by the GDPR.

The European Commission's reply indicates that adequacy could be at risk if the US were to ban strong encryption. That's surprising, because the Commission has generally tried to ignore criticisms -- from the European Parliament, for example -- about the level of data protection in the US. This may just be a little saber-rattling on the Commission's part. But it's a useful hint that a US ban would not just be bad for the Internet, but could also turn out to be bad for the US.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: encryption, eu, privacy, privacy shield, us

Interpol Confirms, Denies It's Against Strong Encryption

from the wait-that-sounded-better-before-we-said-it-out-loud dept

The latest law enforcement agency to offer up its opinion on end-to-end encryption doesn't seem to like it either. Joseph Menn reports for Reuters that Interpol is siding with the FBI, DOJ, and a handful of European government agencies in finding that encryption is bad and lets bad people do bad things.

The international police organization Interpol plans to condemn the spread of strong encryption in a statement Monday saying it protects child sex predators, three people briefed on the matter told Reuters.

At the group’s conference in Lyon, France on Friday, an Interpol official said a version of the resolution introduced by the U.S. Federal Bureau of Investigation would be released without a formal vote by representatives of the roughly 60 countries in attendance, the sources said.

This follows the anti-encryption agitating performed by Attorney General William Barr and FBI Director Chris Wray in response to Facebook's announcement it would add end-to-end encryption to its Messenger service, bringing it more in line with Whatsapp, another of Facebook's acquisitions. Both used the specter of child exploitation to argue against this implementation -- an effort to sacrifice the security of millions for some slight gains in law enforcement efficiency.

Sean Gallagher of Ars Technica obtained a draft copy of the resolution, which adds more redundancy to earlier "think of the children" arguments.

The current path towards default end-to-end encryption, with no provision for lawful access, does not allow for the protection of the world’s children from sexual exploitation. Technology providers must act and design their services in a way that protects user privacy, on the one hand, while providing user safety, on the other hand. Failure to allow for Lawful Access on their platforms and products, provides a safe haven to offenders utilizing these to sexually exploit children, and inhibits our global law enforcement efforts to protect children.

Encryption does not "provide safe havens" for child abusers. This is Interpol's version of AG Barr's "lawless spaces" assertions, which doesn't improve at all on Barr's fatuous statements. As former FBI General Counsel Jim Baker recently pointed out, Barr's argument isn't about where the law is being circumvented, but rather about how he doesn't like the way relevant laws work.

So, encryption has not, as the attorney general complained in his speech, really created a “law free zone.” It’s just that the law that applies in this area is not what Barr or the Justice Department want the law to be.

Interpol could not be reached for comment in time for publication but it sure had a lot to say about the issue now that its apparent stance on encryption has been made public. It told the New York Times' Nicole Peroth the Reuters story was inaccurate.

If you can't read/see the tweet, it says:

Dear Ms Perlroth,

As per our statement there are, and were, no plans at this time for the INTERPOL General Secretariat to issue a statement in relation to encryption.

This contradicts statements made by conference attendees, who said Interpol's resolution/statement was "due to be published this week." Perhaps Interpol has undergone some hasty reconsideration after reading its own words on the pages of multiple press sites. Or maybe the timetable is off. All Interpol is really saying is that it won't be issuing this "at this time." This isn't a rejection of these articles' substance. It appears to be nothing more than a dispute about when Interpol will take a public stance against encryption.

Or maybe it has decided to let the 60 representatives from countries Interpol serves actually vote on the resolution. This would be a far better route than issuing a resolution unilaterally declaring opposition to encryption that many members may not actually support.

Whatever the case, Interpol's suggestion that encryption's main beneficiary is international crime is shortsighted and selfish. It's also dangerous. In a world filled with cyberthreats, efforts to undermine encryption "for the good of the public" won't actually result in the public being better served. It certainly won't make them any better protected.

Filed Under: doj, encryption, fbi, going dark, interpol

FBI's Top Lawyer From The Apple Encryption Fight Says Law Enforcement Needs To Suck It Up And Embrace Encryption

from the didn't-see-that-coming dept

Jim Baker was the FBI's General Counsel during its well-publicized attempt to use the San Bernardino shootings from 2016 as a wedge to force Apple to build a backdoor into its data encryption scheme. As we noted at the time, this seemed like a very clear, somewhat cynical attempt to use a high profile attack as an excuse to force Apple's hand in building back doors. When that battle happened, then FBI director Jim Comey took to the pages of Lawfare to insist that there were good reasons for the FBI to fight with Apple in court to force it to create a backdoor.

Now, Baker has taken to the pages of Lawfare as well to... apparently point out that he and the FBI were totally wrong about all of that and that his former colleagues at the FBI and DOJ need to get it over it and embrace encryption. It's quite a piece.

In the face of congressional inaction, and in light of the magnitude of the threat, it is time for governmental authorities—including law enforcement—to embrace encryption because it is one of the few mechanisms that the United States and its allies can use to more effectively protect themselves from existential cybersecurity threats, particularly from China. This is true even though encryption will impose costs on society, especially victims of other types of crime.

Baker defends his own work on the San Bernardino case, but is now recognizing how dangerous backdoors can be and how important encryption is. He takes current Attorney General William Barr to task for his new anti-encryption propaganda campaign:

The attorney general’s perspective on encryption is far from universal. A range of individuals and groups—including some tech companies, computer scientists, engineers, cybersecurity experts, and privacy and human rights organizations—think that encryption protects both our security and our privacy. See here and here for examples. Well-designed and well-implemented encryption makes it harder for malicious cyber actors to unlawfully hack and steal our communications, personal data and intellectual property. In their view, weakening encryption through the installation of “back doors” on smartphones or in communications systems, or providing law enforcement with “golden keys” to allow them access to encrypted data, jeopardizes all of us. Many would disagree strongly with the attorney general’s assessment that an acceptable technical solution to law enforcement’s problem—one that appropriately balances

all of the equities at issue—actually exists.

Baker even highlights a key point many of us have pointed out in the past. For all the talk of "going dark," law enforcement has more access to information than ever before in history:

Further, the situation for law enforcement may not actually be as bad as some claim. In fact, some argue that society is in a “golden age of surveillance” as substantially more data—especially metadata—than ever before is available for collection and analysis by law enforcement. Finally, critics charge that law enforcement agencies have not provided the public with comprehensive and reliable data to explain exactly how many encrypted devices or communications those agencies encounter as well as the number and type of investigations that encryption negatively impacts.

Indeed, Baker highlights how misleading Barr and others (including Baker's old boss, Comey's) arguments are when they say that encryption leads to a lawless digital space:

So, encryption has not, as the attorney general complained in his speech, really created a “law free zone.” It’s just that the law that applies in this area is not what Barr or the Justice Department want the law to be.

Baker also highlights how undermining encryption puts us all at risk in a wide variety of ways, from basically handing over security services to non-US companies, to putting all our data at risk, to also creating a great opening for countries who wish to do us harm. There are a lot of really great points in this post, way beyond what I'm highlighting here, so I highly recommend reading the whole thing. Indeed, towards the end, Baker (correctly) highlights that protecting our own digital security almost certainly is a better way of protecting Americans than being able to hack into the phones of a few people:

If I’m correct about the existential nature of cyber threats and about the risks that nation-states such as China, in particular, pose to the United States and its allies, then federal, state and local governments should be doing everything they can to enhance the cybersecurity status of the nation. All public safety officials should think of protecting the cybersecurity of the United States as an essential part of their core mission to protect the American people and uphold the Constitution. And they should be doing so even if there will be real and painful costs associated with such a cybersecurity-forward orientation. The stakes are too high and our current cybersecurity situation too grave to adopt a different approach.

A key theme throughout the whole piece is that it's time for law enforcement to accept reality and to stop pretending there's some fantasy "magic bullet" or "golden key" that will allow them to safely backdoor their way into encrypted devices. He admits that this may, sometimes, make law enforcement's job harder, but the benefits for everyone's safety so vastly outweigh that potential downside as to suggest this shouldn't even be much of a debate.

All of this is stuff that many of us who have fought against encryption backdoors have been saying for decades, but it's pretty surprising (to the level of almost shocking) that Baker is now expressing this view -- given his role in literally working to backdoor Apple's encryption. This is not a privacy activist. This is someone who was basically in charge of the FBI's last big effort to have the courts break encryption. Baker insists that his actual views haven't changed very much, though that does seem at least somewhat difficult to square with the FBI's position in the Apple legal fight. But, either way, it's great to see someone of his stature and experience now agreeing that undermining encryption would be very, very dangerous -- and that he's willing to tell his former colleagues, directly, that they, too, should embrace this position.

Filed Under: backdoors, encryption, fbi, going dark, jim baker, law enforcement, san bernardino, william barr

Facebook's Sues Israeli Malware Marketer With A Lawsuit That Aims To Make An Easily-Abused Law Even More Abusable

from the OK-BOOMER dept

Facebook is suing Israeli exploit developer NSO Group for utilizing WhatsApp to target 1,400 users with malware that allowed NSO's clients to circumvent the chat app's end-to-end encryption.

That NSO is being accused of helping bad people surveill good people is not news. NSO is not very selective when it comes to selling malware, putting its powerful tech in the hands of governments that seem just as likely to target NSO's home country as they are to target local dissidents, journalists, and activists. NSO's software and cavalier approach to sales have been exposed by multiple Citizen Lab investigations, which have outed NSO's sales to blacklisted countries.

Facebook's lawsuit [PDF] basically echoes the findings of Citizen Lab.

In a lawsuit filed in federal court in San Francisco, messaging service WhatsApp, which is owned by Facebook Inc (FB.O), accused NSO of facilitating government hacking sprees in 20 countries. Mexico, the United Arab Emirates and Bahrain were the only countries identified.

WhatsApp said in a statement that 100 civil society members had been targeted, and called it “an unmistakable pattern of abuse.”

Abusive it is, especially when you're trying to tout the benefits of end-to-end encryption, only to have a malware developer show you how easy it is to route around these protections. NSO's malware was spread using WhatsApp's video chat feature, which apparently allowed government agencies to eavesdrop on communications and possibly access device contents.

This isn't the only lawsuit NSO is facing.

NSO came under particularly harsh scrutiny over the allegation that its spyware played a role in the death of Washington Post journalist Jamal Khashoggi, who was murdered at the Saudi Consulate in Istanbul a little over a year ago.

Khashoggi’s friend Omar Abdulaziz is one of seven activists and journalists who have taken the spyware firm to court in Israel and Cyprus over allegations that their phones were compromised using NSO technology. Amnesty has also filed a lawsuit, demanding that the Israeli Ministry of Defense revoke NSO’s export license to “stop it profiting from state-sponsored repression.”

This matters enough to NSO for it to engage in a very limited charm offensive. It has promised to abide by UN guidelines on human rights abuses, which means it's going to have to trim a few countries off its client list. It also claims to have saved the lives of "tens of thousands" of people. It's a great claim to make, especially when no one really expects you to back up it up with evidence or data.

But the lawsuit Facebook is pursuing is questionable, if not a bit dangerous. Facebook likely doesn't have a way to block NSO clients from accessing WhatsApp. It has permanently deleted the accounts of every employee of NSO Group it could find for "violating" Facebook's terms of use. But it's helpless to root out accounts used by NSO's customers, since these aren't nearly going to be as obvious as those belonging to people who list NSO as their employer.

That explains the lawsuit and Facebook's desire to obtain a permanent injunction against NSO Group, blocking it from utilizing WhatsApp to spread malware. But the lawsuit is on pretty shaky legal ground. Worse, if Facebook somehow prevails, the much-abused CFAA will be rewritten in a way that's going to harm plenty of people who've never sold malware to known human rights abusers.

Here's Wired's Andy Greenberg (and defense attorney Tor Ekeland) explaining just one of the problematic aspects of Facebook's lawsuit.

To make that charge stick, WhatsApp will have to show that NSO obtained illegal access to WhatsApp's own systems. Given that NSO's targets were WhatsApp users rather than, say, WhatsApp's servers, they'll have to find an argument that they, as the plaintiff, were the victim. "The fundamental question is, what’s the unauthorized access?" says Ekeland. "You might be able to argue that NSO hacked WhatsApp and not just their users. Maybe they’re trying to make that argument. But they’re not being clear about it, and that lack of clarity is an attack vector for the defendant."

Facebook's on a clear path if it chooses to stick with the argument NSO violated its terms of service. Those terms specifically forbid reverse-engineering code or sending malware via the app. But even if it's limited to that, the obvious solution is for Facebook to ban NSO from using its services. That may be close to impossible to do since Facebook doesn't have access to its client list or their user accounts. Arguing past that point may cause problems, though.

While it may work out for Facebook to have the CFAA cover "uses of our stuff that we don't like," it's going to harm a lot of other people. Security researchers, regular researchers, and anyone else who might use Facebook's platform or apps in a way Facebook doesn't like could be prosecuted or sued under this definition. While it's plainly advantageous for Facebook to force all users to use its products only in a way it approves, the downside is a garden with higher walls that put users completely at the mercy of Facebook. Since terms of use can be rewritten on the fly and applied immediately, Facebook could go after "violators" who aren't even aware they've actually violated anything.

Adding to Facebook's hurdles is a recent Ninth Circuit Court of Appeals ruling (this lawsuit is filed in the Ninth Circuit) that says scraping a site for data -- even when forbidden by the terms of use -- isn't necessarily a violation of the CFAA. Making this tougher for Facebook is there's no evidence it ever gave NSO prior notice its abuse of WhatsApp was forbidden. The lack of notice makes it a bit more difficult for Facebook to claim NSO knowingly violated the terms by using WhatsApp to distribute malware. It will be tough to prove NSO clients had unauthorized access, especially since Facebook didn't get around to permabanning anyone until after it filed its lawsuit.

I'm no fan of NSO and its client list, but I'm no fan of Facebook's lawsuit, either. An opinion finding using internet services in a way their developers don't like is not the precedent we need -- not if we're going to keep pushing for a safer internet for everyone. It will allow dominant players to establish rules that benefit the platforms and stave off competition from third-party offerings that attempt to address shortcomings major platforms refuse to correct. It will also prevent researchers from making online services safer or better, which will be a net loss for all platform users, even if it prevents a handful of authoritarians from exploiting a single service to target the people they think need more surveilling.

There's a lot at stake here but Facebook can't see past its immediate (and somewhat convenient, given its recent rakings over Congressional coal) desire to appear to be the good guy for once.

Filed Under: cfaa, encryption, hacking, key logger, malware
Companies: facebook, nso group, whatsapp

DOJ's Latest Child Porn Site Takedown Shows Encryption Isn't Really Stopping The Feds From Fighting Child Porn

from the welcome-to-basic-detective-work dept

The DOJ just delivered a counterargument to its own anti-encryption rhetoric. Attorney General William Barr, Deputy AG Jeffrey Rosen, and FBI Director Chris Wray recently spent some time decrying the increasing use of encryption to secure personal communications.

The latest attack on encryption was prompted by Facebook's announcement that it would be adding end-to-end encryption to its Messenger service. Three governments (US, UK, Australia) joined forces to tell Facebook it was wrong. They promised Facebook's inability to snoop on its users' messages would allow thousands of child porn producers and consumers to escape justice.

And yet the DOJ, FBI, and others are still managing to track down and arrest criminal suspects -- all without having access to encryption backdoors or compromised communication services. As Jason Koebler reports, another child porn investigation has led to the takedown of a dark web site.

The Department of Justice announced on Wednesday that it has seized and shut down Welcome to Video, one of the world’s largest dark web child porn websites in a worldwide law enforcement action.

Law enforcement has arrested 337 alleged pedophiles in 38 countries around the world and has rescued 23 children from abusive situations as part of the operation, the DOJ said in a press conference on Wednesday.

No backdoors were needed to track down the owner of the server or hundreds of the site's visitors. For that matter, the FBI didn't even need a warrant. The FBI did not deploy its infamous NIT (Network Investigative Technique) to track down site users. The flaw was the payment system linked to the site. Users may have thought their Bitcoin transactions couldn't be traced back to them, but they were wrong.

According to an indictment, law enforcement was able to track users of the site on the blockchain not because of the design of Bitcoin itself, which is pseudonymous, but because “virtual currency exchanges were required by US law to collect identifying information of their customers and verify their clients’ identities.”

Many financial records are third-party records. No warrants needed. Investigators sent Bitcoin to the child porn site's wallet multiple times, managing to suss out the wallet's owner. Somewhat conveniently, the owner's phone number and email account were listed with the exchange. Investigators then began digging up info on other users who were sending Bitcoin to the same wallet, using the mandated data collection to unmask site visitors. Coinbase was handed a subpoena and Coinbase handed over users' info.

The DOJ's overwrought anti-encryption arguments aside, there's another concerning aspect of this investigation -- one the DOJ is far less willing to discuss. As Koebler points out, the DOJ apparently let the site operate for months, if not years, to track down as many site visitors as possible.

The indictment [PDF] indicates investigators were aware of the site's existence since 2015. At some point between then and the operator's arrest in March of 2018, investigators purchased site credits and downloaded child porn. The indictment does not say when the DOJ took control of the site and/or shut it down. It doesn't appear the FBI or any other law enforcement agency continued to run the site after its seizure (as the FBI has done in other cases), but it is disturbing multiple law enforcement agencies felt it was better to leave the site up and running -- and victimize more children in the process -- than shut it down as soon as possible with the understanding some site visitors might escape prosecution.

The facts of this case undermine the DOJ's assertions about the necessity of encryption backdoors to successfully investigate and prosecute child porn producers and distributors. This case even undercuts its arguments about cellphone encryption, as the FBI's testimony [PDF via Cyrus Farivar] shows it didn't have to make any effort at all to access the contents of an arrestee's phone.

Q. Did he have a cellphone on him at the time you encountered him?

A. Yes.

Q. Did you seize that?

A. Yes.

Q. Did he voluntarily provide the password --

A. Yes.

Q. -- passcode to it?

A. Yes.

Encryption isn't the roadblock the DOJ's rhetoric makes it appear to be. It may make some investigations more difficult, but it certainly doesn't make them impossible. The DOJ can still protect children without making communications less secure for millions of people. It's not zero sum. It's a tradeoff -- something the DOJ is familiar with. It trades the continued exploitation of children for a few more prosecutions when it takes on child porn sites. If it's willing to allow children to be hurt to save children, you'd think it would be a bit more cautious when suggesting the public should give up its security in exchange for the DOJ's idea of "public safety."

Filed Under: child porn, doj, encryption, fbi, investigations
Companies: welcome to video

Ed Snowden: Governments Can't Make The Public 'Safer' By Undermining The Encryption Essential To The Public's Security

from the DOES-NOT-COMPUTE dept

With the DOJ uniting with the UK and Australian governments to decry the use of end-to-end encryption by messaging services, it's again time to remind people why encryption matters. The way these government entities see it, encryption mainly helps criminals. Apparently, it's simply not necessary for law-abiding citizens to have secure communications.

This is wrong on many levels, starting with the insistence there's a safe way to circumvent encryption. There isn't. But multiple government agencies claim tech companies are overstating the reality, when all they're actually doing is stating the obvious.

Someone who knows a thing or two about the importance of encrypted communications has written an op-ed for The Guardian. Ed Snowden's article points out why citizens should be alarmed governments are trying to make their personal communications less secure for the children or the greater good or whatever.

For more than half a decade, the vulnerability of our computers and computer networks has been ranked the number one risk in the US Intelligence Community’s Worldwide Threat Assessment – that’s higher than terrorism, higher than war. Your bank balance, the local hospital’s equipment, and the 2020 US presidential election, among many, many other things, all depend on computer safety.

And yet, in the midst of the greatest computer security crisis in history, the US government, along with the governments of the UK and Australia, is attempting to undermine the only method that currently exists for reliably protecting the world’s information: encryption. Should they succeed in their quest to undermine encryption, our public infrastructure and private lives will be rendered permanently unsafe.

Encryption for communications encompasses far more than the idle chatter of social media users. Facebook is the target of the combined force of the US, UK, and Australian governments -- thanks to its plans to add end-to-end encryption to its Messenger service -- but other platforms and services providing encrypted communications will be next on the block if Facebook is deterred from offering this protection. Or worse, talked into creating a backdoor so either it -- or government agencies -- can spy on users' communications.

As Snowden points out, actual infrastructure is at stake. Encrypted communications are vital to the security of plenty of things even governments would like to see remain secure. And yet, they're willing to paint encryption as an accomplice to criminal acts, rather than the vital necessity it actually is.

If Facebook is willing to limit the amount of data it can harvest from its users by locking up Messenger so tight even it can't see the messages, providing encryption must not only be of value to users, but to Facebook itself. This cuts against the DOJ's ridiculous arguments that no one is demanding secure communications -- a statement that insinuates private companies are sticking it to the man just to stick it to the man.

These governments are claiming the introduction of encryption will make it impossible to investigate criminal acts. The one most frequently cited is the production and distribution of child porn. Recent cases make it clear encryption isn't preventing law enforcement agencies from tracking down criminals or shutting down their dark web services. The DOJ and others still have a wealth of investigative tools at their disposal. Private conversations that remain private doesn't change all that much. The history of criminal activity includes millions of conversations law enforcement agencies had no access to, and yet, they still managed to arrest and prosecute criminals.

This isn't about making anyone safer or preventing encrypted services from becoming ad hoc child porn servers. This is about what works easiest and best for governments.

The true explanation for why the US, UK and Australian governments want to do away with end-to-end encryption is less about public safety than it is about power: E2EE gives control to individuals and the devices they use to send, receive and encrypt communications, not to the companies and carriers that route them. This, then, would require government surveillance to become more targeted and methodical, rather than indiscriminate and universal.

The "public safety" argument doesn't make sense. The public doesn't achieve a net "safety" gain when its private communications are compromised. But it makes sense to these governments, which have often considered the rights they promised to respect as inconveniences to be routed around or removed completely.

Filed Under: chris wray, doj, ed snowden, encryption, fbi, going dark, william barr

The Ultimate Aim Of China's 2016 Cybersecurity Law Is Now Clear: Nothing Digital Can Be Secret From The Authorities

from the looking-at-you,-too,-foreign-companies dept

It's no secret that China is tightening its control of every aspect of the online world -- Techdirt has been reporting on the saga for years. But what may not be so clear is how China is doing this. It is not, as many might think, the direct result of diktats from on high, but flows naturally from a massive program of carefully-crafted laws and new government initiatives created with the specific intent of making the online world subservient to the Chinese authorities. Central to this approach is a law passed three years ago, generally known in the West as "China's cybersecurity law".

A review of the law in 2017, by the New America think tank, brought some useful clarity to complicated political landscape. It names a number of powerful players involved, including the Cyberspace Administration of China, the Ministry of Public Security, the Ministry of Industry and Information Technology, the country's military and intelligence establishment, and BAT -- Baidu, Alibaba, Tencent -- China's Internet giants. The legal framework is also complex. The 2017 article picks out six "systems": the Internet Information Content Management System; the Cybersecurity Multi-Level Protection System; the Critical Information Infrastructure (CII) Security Protection System; the Personal Information and Important Data Protection System; the Network Products and Services Management System; and the Cybersecurity Incident Management System.

Clearly, there's a huge amount of activity in this area. But because of the many interlocking and interacting elements contributing to the overall complexity, it's hard to discern what's key, and what it will all mean in practice. A 2018 report on the law from the Center for Strategic & International Studies noted that one of the systems -- the Multi-Level Protection System (MLPS) -- has a far wider reach than its rather bland name implies:

MLPS ranks from 1-5 the ICT networks and systems that make up China's CII based on national security, with Level 5 deemed the most sensitive. Level 3 or above triggered a suite of regulatory requirements for ICT products and services sold into that CII, including indigenous Chinese IP in products, product submission to government testing labs for certification, and compliance with encryption rules banning foreign encryption technology.

That in itself is not surprising. Governments generally want to know that a country's digital infrastructure can be trusted. However, it turns out these rules will apply to any company doing business in China:

MLPS 2.0 will cover any industry with ICT infrastructure because it covers the vague category called "network operators," which can include anyone who uses an ICT system. MLPS 2.0 also appears to have a focus on cloud computing, mobile internet, and big data.

That extremely broad reach has been confirmed following the recent appointment of a big data expert to oversee the implementation of MLPS. The China Law Blog has analyzed several Chinese-language articles giving details of this move, and what emerges will be deeply troubling for any foreign business operating in China:

This system will apply to foreign owned companies in China on the same basis as to all Chinese persons, entities or individuals. No information contained on any server located within China will be exempted from this full coverage program. No communication from or to China will be exempted. There will be no secrets. No VPNs. No private or encrypted messages. No anonymous online accounts. No trade secrets. No confidential data. Any and all data will be available and open to the Chinese government.

As the China Law Blog explains, this means that there will be important knock-on consequences:

Under the new Chinese system, trade secrets are not permitted. This means that U.S. and EU companies operating in China will now need to assume any "secret" they seek to maintain on a server or network in China will automatically become available to the Chinese government and then to all of their Chinese government controlled competitors in China, including the Chinese military. This includes phone calls, emails, WeChat messages and any other form of electronic communication.

As previous Techdirt posts have reported, China has been steadily moving in this direction for years. Nonetheless, seeing the endgame of the authorities -- unchecked access to everything flowing through Chinese networks -- confirmed is still troubling. The intentions are now clear, but a key unanswered question is how rigorously the strategy will be enforced. The situation for social media censorship in China gives some grounds for hope. An article on the Asia Dialogue site explains:

Despite the broad and still expanding legal framework, the actual implementation of China’s information control is neither monolithic nor consistent. While the Chinese government is increasingly adept at managing and using new media and advanced technologies to its advantage, it also relies heavily on private companies to carry out government directives on a daily basis.

The same may be true for the implementation of MLPS 2.0 in particular, and China's cybersecurity law in general. If it isn't, Western companies are likely to find operating in the country even more difficult than it is now, when it is hardly plain sailing.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: china, cybersecurity, cyberspace administration, encryption, ministry of public security, privacy, secrecy, surveillance

Trump Administration Demands An End To Strong Encryption While Being Exhibit A For Why We Need It

from the secrets-we-keep dept

In the 18th Century the Founding Fathers were worried about tyrants. They were worried about government officials abusing the powers of their office and the fate of the nation if there were no check on their power. In the 21st Century those concerns have hardly faded. Today we have a presidential administration that, if nothing else, has publicly (and privately) attempted to turn the ship of state against multiple political opponents, and with such an audacious expectation of impunity that it leaves no basis to believe it would not do the same to anyone else who stands against it.

It now it demands more tools to perpetuate these attacks. At a time when the survival of our democracy most critically depends on the people's ability to push back against these sorts of abuses of governmental power, the government seeks to hobble the public's ability to do it –- this time by destroying the ability to keep their communications secret. Because that's what encryption "backdoors" do: completely and utterly obliterate any technical ability to maintain the secrecy in one's data. You can't just backdoor them a little bit -– either communications are secure from all prying eyes, or none of them. And this administration is insisting that it should get to see them all.

This administration is not, of course, the first to have demanded the ability to get access to people's data. Both Democratic and Republican administrations have made similar demands (and even helped themselves to it). Each time they have articulated policy arguments for why the government should have the power to read people's private communications, and sometimes these arguments have even been compelling. But none have ever outweighed the critical liberty interest that depends on being able to prevent government access to all of everyone's private communications, and today we see exactly why.

The Constitution guarantees the personal freedom necessary to stand against a tyrannical state actor prone to misusing its power. We have been sloppy over the years in preserving that liberty legally, thanks to the implicit assumption that the government is inherently one of the Good Guys and the people seeking to keep their data private presumably are the Bad Guys. It is a view that has infected our understanding of the Fourth Amendment and allowed the government to invade people's privacy in ways the text of the Constitution never allowed. But today we see with painful clarity how it was also a view predicated on wholly unsound assumptions.

Today we regularly see our President, Chief Executive, and most senior official charged with enforcing our laws not only routinely flout these very same laws but also routinely threaten those whose sole "crime" is standing against him with vindictive, and meritless, ruinous prosecution. These are not the actions of a benevolent government eager to protect the public from wrongdoing. They are the actions of an autocrat all too happy to victimize people as willingly as the most hardened criminal.

Which leaves the public on its own to protect itself, and already significantly hampered. It is bad enough that Trump makes it so treacherous to speak out against him publicly. But when we can no longer speak publicly it becomes all the more important that we be able to speak privately – yet that is exactly what this administration is trying to prevent in demanding encryption backdoors. Should it get its wish, no one will be able to keep secrets from this administration, or challenge its power. It will be able to continue its abuses unchecked.

This untenable state of affairs is not what the Founders had in mind, what the Constitution permits, or what our continued democracy can tolerate. It is thus vital to resist this backdoor demand.

Filed Under: authoritarianism, backdoors, doj, encryption, free speech, going dark, privacy

The DOJ Is Conflating The Content Moderation Debate With The Encryption Debate: Don't Let Them

from the it's-not-the-same dept

As we've detailed a lot over the last week, the DOJ has decided that after years of failing to get backdoors mandated by warning about the "terrorism" bogeyman, it's decided to pick up the FOSTA playbook, and instead start focusing on child porn -- or what "serious people" now refer to as Child Sexual Abuse Material (CSAM). It did this last week with an assist from the NY Times, who published an article with (legitimately) scary stories, but somehow blaming the internet companies... because they actually report it when they find such content on their networks. I've seen more than a few people, even those who generally have been strong voices on the encryption debate and against backdoors, waver a bit on this particular subject, and note that maybe there shouldn't be encryption on social media networks, because it might (as the narrative says) help awful people hide their child porn.

Except... that's confusing a few different things. Mainly, it's mixing up the content moderation debate with the "lawful access" or "backdoors" debate. Yes, encryption makes it harder for the police to get in and see certain things, but that's by design. We live in a country with the 4th Amendment, in which we believe that it should be difficult for law enforcement to snoop deeply into our lives -- and that's always meant that some people will do and plot bad stuff out of the sight and hearing of law enforcement. Yet, if you were to look at law enforcement over the past 100 years, you can bet that they have many times more access to information about people today than they have in the past. The claim of "going dark" is laughable when you compare the information that law enforcement can get today even to what it could get 15 or 30 years ago.

But, importantly, bringing CSAM into the debate muddies the water by pretending -- incorrectly -- that in an end-to-end encrypted world you can't do any content moderation, and there's simply no way for platforms to block or report certain kinds of content. Yet, as Princeton professor Jonathan Mayer highlights in a new paper, content moderation is not impossible in an encrypted system. It may be different than it is today, but it's still very much possible:

Much of the public discussion about content moderation and end-to-end encryption over the past week has appeared to reflect two common technical assumptions:

1. Content moderation is fundamentally incompatible with end-to-end encrypted messaging.
   
2. Enabling content moderation for end-to-end encrypted messaging fundamentally poses the same challenges as enabling law enforcement access to message content.

In a new discussion paper, I provide a technical clarification for each of these points.

1. Forms of content moderation may be compatible with end-to-end encrypted messaging, without compromising important security principles or undermining policy values.
   
2. Enabling content moderation for end-to-end encrypted messaging is a different problem from enabling law enforcement access to message content. The problems involve different technical properties, different spaces of possible designs, and different information security and public policy implications.

You can read the whole thing, but as the paper notes, user reporting of such content still works in an end-to-end encrypted world, as does hash matching if done at the client end. There's a lot more in there as well, but what you realize in reading the paper is that while law enforcement has now latched onto the CSAM issue as its hook to break encryption (in part, I've been told by someone working with the DOJ, because they found it "polled well"), it's an entirely different problem. This is yet another "but think of the children" argument, which ignores the technical and societal realities.

Filed Under: chris wray, content moderation, doj, encryption, going dark, jonathan mayer, william barr
Companies: facebook