FBI Director Deploys Straw Men While Calling For The End Of Straw Men Arguments In The Encryption War

from the let-he-who-is-without-straw... dept

The DOJ's anti-encryption summit went off without a hitch. And why wouldn't it? No one who had anything good to say about encryption was invited. The only speaker without a history of criticizing encryption was John Walsh of "America's Most Wanted," who detailed the kidnapping of his son -- an event that took place long before encryption was viewed as an impediment to law enforcement.

Using a bit of the FOSTA playbook, but skewing it younger to facilitate appeals to emotion, the "summit" attempted to discuss the "creation" of "lawless spaces" resulting from end-to-end encryption. Facebook was front and center as the recent recipient of a letter from Attorney General William Barr, asking it to ditch its plans to encrypt Messenger communications.

Barr (who's already made his feelings about encryption clear) was joined by Deputy AG Jeffrey Rosen, FBI Director Chris Wray, UK Home Secretary Priti Patel, and Australia's Minister of Home Affairs Peter Dutton. No one representing the tech industry was included. Nor were any encryption experts. This was a preach-to-the-converted type of event and the speakers all made the most of it.

FBI Director Chris Wray offered his unsurprising take on encrypted communications: he's against it. Not that his opinion should be considered in any way an "expert" opinion. He runs an agency that can't even correctly count the number of encrypted devices it has in its possession. And it's the same agency where officials did everything they could to avoid unlocking a seized phone in a mass shooting case in hopes of securing favorable court precedent. Wray frequently presents the hardest skew on the issue (at least at the federal level), and his comments at the summit were no exception.

[I]f we don’t confront these real-life horrors happening to real people, if we don’t take action and do something soon to address the lawful access problem, it will be too late and we’ll lose the ability to find those kids who need to be rescued. We’re going to lose the ability to find the bad guys who need to be arrested and stopped. And we’re going to lose the ability to keep the most vulnerable people we serve safe from harm. We just cannot let that happen.

Technology has made life much easier for the good guy—there’s no doubt. But it’s also made life much easier for a wide range of bad guys—including international and domestic terrorists, hackers, opioid traffickers, and child predators. Like other criminals, child predators routinely rely on encrypted phones and laptops to store explicit photographs and exchange illegal media, contact victims, and coordinate with co-conspirators over encrypted messaging platforms.

These devices and platforms have become spaces where vital rules—against soliciting child abuse, against trading in and feeding that abuse, against threatening abuse victims struggling to make a normal life—can no longer effectively be applied.

The key word here is "effectively." Wray wants immediate access in exchange for a warrant. While end-to-end encryption may make it harder to obtain the content of communications from service providers, it does not make it impossible. There are vendors offering tools that can bypass phone encryption to access communication contents. Suspects have been known to volunteer passwords. More than one court has found that the application of biometric features to unlock devices does not violate the Fifth Amendment. Any number of third parties hold data that can give investigators clues about message content and link suspects with conspirators.

Going directly through Facebook -- and Facebook is the unspoken target of this "summit", thanks to its announcement of end-to-end encryption for Messenger -- is just not going to be a very useful option. Wray believes encryption shouldn't be able to defeat a warrant. But that short-sighted view ignores the fact that not every warrant results in the securing of evidence… or enough evidence to secure a guilty verdict.

The issue here is Facebook's plans for Messenger. According to stats mentioned in Barr's letter (and comments delivered by others), 70% of Facebook's 16 million child exploitation tips came from this service. Once the encryption is applied, even Facebook won't be able to see the contents of these communications. That's what the FBI, DOJ, and overseas government officials are hoping to prevent.

It's a legitimate concern, but it's being discussed with a lot of illegitimate arguments. Wray tries to pretend it's everyone else being disingenuous while he boldly speaks truth to tech power. But even this assertion is contradicted by Wray's statements.

I’m well aware that encryption is a provocative subject for some. Although I will tell you, I get more than a little frustrated when people suggest that we’re trying to weaken encryption—or weaken cybersecurity more broadly. We’re doing no such thing. And dispensing with straw men would be a big step forward in this discussion. Cybersecurity is a central part of the FBI’s mission. It’s one part of the broader safety net we try to provide the American people: not only safe data, safe personal information, but also safe communities, safe schools.

We also have no interest in any “back door,” another straw man. We—the FBI, our state and local partners—we go through the front door. With a warrant, from a neutral judge, only after we’ve met the requirements of the Fourth Amendment. We’ve got to look at the concerns here more broadly, taking into account the American public’s interest in the security and safety of our society, and our way of life. That’s important because this is an issue that’s getting worse and worse all the time.

Actually, no. It's still really safe and secure in the United States. Our "way of life" is under no greater threat in an era of increased encryption use than it was before this became the FBI's pet issue. In fact, we're safer today in terms of crime rates and terrorist activity than we've been in more than two decades.

Wray has built his anti-encryption side hustle on a pile of straw men. It's pretty rich to see him arguing no one else should have the privilege to argue their points as disingenuously as he has.

People want safety. People want security. These are inextricably intertwined, but Wray thinks it's possible to separate one from the other without a net loss in safety. And he can't even be honest about how he plans to do it. No one on this panel is willing to call the back doors they want "back doors." No, it's always something else. If the front door is the user's access to their communications, anyone coming in through another entrance is likely going to be viewed as using the back door. If the FBI prefers, we could just call it "using the bedroom window." It doesn't really matter what it's called when it's still access to encrypted communications that's achieved by going through anyone else but the end user.

Wray says everyone else -- everyone who doesn't immediately agree the security trade-off the FBI is pitching is worth it -- is wrong. We're allying ourselves with the most heinous criminals and actively thwarting law enforcement. We're all Wray's straw men now.

So to those out there who are resisting the need for lawful access, I would ask: What’s your solution? How do you propose to ensure that the hardworking men and women of law enforcement, sworn to protect you and your families, actually maintain lawful access to the information they need to do their jobs? What will you say to victims who are denied justice—or left unrescued—in the name of some incremental amount of additional data security?

Why limit your appeal to emotion when you can also appeal to authority? That's the rhetoric Wray is delivering to people who think he's right and will never push back against his oversimplifications, even as he decries the oversimplifications of others. What a train wreck.

It's not an "incremental amount." It's either secure or it isn't. It's not an incremental issue. I would say to the imagined crowd of "hardworking law enforcement" officers that demanding people relinquish their security just to make it easier for the government to access private communications is a bullshit deal. I'm sure Wray knows this. He just seems not to care.

Filed Under: chris wray, doj, encryption, fbi, going dark

Deputy Attorney General Rosen: Companies Like Facebook Are Making Everyone Less Safe By Offering Encryption

from the 'for-the-children'-beats-out-'because-terrorism' dept

The federal government's anti-encryption push is starting to turn into a really weird movement. Yanking pages from the FOSTA playbook, Attorney General William Barr threw an anti-encryption party featuring him, FBI Director Chris Wray, Deputy AG Jeffrey Rosen, and some overseas critics of secure communications.

It was full of loaded language, beginning with the conference's name:

Lawless Spaces: Warrant-Proof Encryption and Its Impact On Child Exploitation Cases

This is how the DOJ and FBI are going to play this game: the specter of exploited children vs. secure communications for millions of Facebook users. Facebook is definitely the target. This conference -- which featured zero tech experts or encryption advocates -- was preceded by the announcement of a data-sharing agreement between the US and UK government that namechecked Facebook's Messenger and WhatsApp.

It was also preceded by Attorney General William Barr's letter to Facebook, asking it to drop its plans to add end-to-end encryption to Messenger. The letter, signed by the participants in this one-sided conference, said the addition of encryption -- without some form of "lawful access" -- would result in massive amounts of undetectable child exploitation.

Now that William Barr has said his piece, the floor has been opened up to DOJ Deputy Attorney General Jeffrey Rosen. Rosen's pitch isn't all that different from the one Barr laid out in his open letter to Facebook. But Rosen does add a bit more color to his in the form of questionable analogies.

Outside the digital world, none of us would accept the proposition that grown-ups should be permitted to mingle in closed rooms with children they don’t know in order to groom them for sexual exploitation. Neither would we ever accept the idea that a person should be allowed to keep a hoard of child sexual abuse material from the scrutiny of the justice system when all of society’s traditional procedures for protecting the person’s privacy, like the Fourth Amendment’s warrant requirement, have been satisfied. But in the digital world, that is increasingly the situation in which we find ourselves.

First off, no one finds the propositions Rosen offers acceptable -- not the digital variety nor the real-world version. However, both versions still happen, with or without "lawful access." It's not that the DOJ and FBI shouldn't go after child exploiters. It's that pretending that undermining encryption will cause "lawless spaces" to cease to exist isn't an honest approach.

To be fair, Rosen isn't saying exactly that. But what he's pitching is encryption backdoors that will result in millions of insecure communications for millions of people. The potential for harm is immeasurable. But we -- and our service providers -- should apparently be willing to take that risk so law enforcement has easier access to these communications. That's the trade-off being demanded, even if Rosen, Barr, etc. aren't intellectually honest enough to use those exact words.

The intellectual dishonesty continues with Rosen's refusal to call backdoors "backdoors."

I am not for a moment suggesting that we should “weaken” encryption. As we confront the problem of “warrant-proof” encryption, nobody is calling for secret “back doors” to communications systems, even though that is often how the issue is misreported. As FBI Director Wray said this morning, law enforcement seeks a front door — that is, access through a transparent and publicly acknowledged system, and only once we have secured the authorization of a court. And we don’t want the keys to that door. The companies that develop these platforms should keep the keys, maintaining their users’ trust by providing access to content only when a judge has ordered it.

If you put an entrance anywhere, the building is compromised. A hole in a wall, floor, roof, wherever, is still a hole. It doesn't matter who holds the keys. The keys exist and can be copied or misplaced. Law enforcement may need a warrant, but criminals and state actors only need access to the key. Dressing it up as an escrow system doesn't magically make this problem go away.

Rosen is calling for more than backdoors. Using another emotional argument, Rosen appears to saying the government should be allowed to eavesdrop on encrypted communications.

Every day, companies like AT&T, Verizon, and Sprint provide law enforcement with targeted lawful access to the content of phone communications in ways that promote public safety — but only after the government has complied with the rigorous requirements of the law, and a judge has authorized access. Why should internet technology companies operate under different rules? For a young girl who is being trafficked for sex, it makes no difference whether her tormenters are communicating via traditional voice calls over a cell phone, or via an encrypted internet app. But it makes a huge difference to the investigators trying to find her, as they can gather the first category of electronic evidence, but not the second. From a policy point of view, it doesn’t make any sense.

The example Rosen uses is wiretaps. The FBI would definitely like to be the unseen party to any number of conversations, especially now that most of them don't take place over the phone. With this, Rosen is asking for more than unencrypted access to data at rest. He's asking for a "non-backdoor" that allows investigators to intercept communications. This increases the complexity of the government's demands and the insecurity of the targeted app's users.

Rosen says 70% of 16 million child sexual abuse reports Facebook made last year originated from its Messenger service. Once end-to-end encryption is applied, these messages will no longer be visible to Facebook, in addition to being less accessible to law enforcement. He compares the millions of Facebook reports to the very limited number produced by Apple, which has provided end-to-end encryption for a few years now. Apple has forwarded a little over 200 tips over the last three years. As Rosen conjectures, it can't simply be because no child abusers use iPhones.

Rosen isn't wrong. Encryption will result in far fewer reports, if Facebook can't scan messages for child porn. But he's completely wrong in his portrayal of the trade-offs being made.

Some companies have completely favored the privacy of their users over the safety of their users.

This isn't about privacy, even though there is definitely a net privacy gain. It's about security, something even the government realizes is essential for electronic communications. But the government wants less security for everyone, in exchange for an unknown quantity of law enforcement "wins." Rosen actually says users are "safer" when their communications providers scan communications for illicit content -- an argument few outside the FBI and DOJ would make. Rosen is spinning this from the viewpoint of law enforcement riding to the rescue of victimized children. But it won't just be the FBI making use of backdoors or intercepted communications. It will also be governments who treat criticism and dissent as crimes, which definitely makes things less safe for millions of people around the world.

Rosen closes with this last bit of intellectual dishonesty:

If we are to move to a world where even judge-approved search warrants become useless to the protection of exploited children, and to public safety more broadly, our country needs an open discussion of the costs some such technology platforms will be imposing on all of us. If our efforts to make the virtual world more secure leave us more vulnerable in the physical world, that decision should be an informed one.

But Rosen and the agencies he's speaking for don't want an "informed" decision. They've spent years blowing off experts who say what they want will result in less security and safety for users, as well as pointing out the impossibility of creating a "secure" backdoor. You only need to look at the speaker list for this event to see the DOJ and FBI aren't interested in being informed. When the only people being asked for opinions are those who think undermining encryption is a necessity, you're going to come to the conclusion that undermining encryption is a necessity.

Filed Under: doj, encryption, going dark, jeffrey rosen, security
Companies: facebook

DOJ Boss Joins UK, Australian Gov't In Asking Facebook To Ditch Its End-To-End Encryption Plan

from the [stacks-exploited-bodies-higher]-MR-FACEBOOK-PLEASE dept

The DOJ seems to be handling its anti-encryption (a.k.a. "going dark") grief badly. I doubt it will ever reach "acceptance," but it is accelerating through the rest of the stages with alarming speed.

It went through shock first, personified by former FBI director Jim Comey, who insisted tech companies were offering encryption to:

A. Give the feds the middle finger
B. Enable all sorts of dangerous criminals
C. To act like children in a roomful of adults

"Denial" seems to have been bypassed completely. Instead, Comey (and others) repeated the "shock" stage, banging the table louder and louder in hopes of convincing everyone they were right.

They weren't right and encryption deployments continued.

The FBI and DOJ shifted quickly to anger. This was first displayed during the legal fight over the San Bernardino shooter's iPhone. The DOJ insisted a law nearly 230 years old gave it permission to force Apple to break encryption. Apple disagreed. The court disagreed. The FBI insisted this would be the death of us all and ignored outside offers to crack the phone while pursuing precedent it would never obtain.

The phone was eventually cracked by a third party and the FBI moved on, still clinging to its "going dark" narrative, even as vendor after vendor stepped up to provide phone-cracking tools. It also overstated the number of "uncrackable" devices in its possession by at least 6,000 devices. It has been nearly 17 months since the FBI promised to correct this count. It still has yet to provide an updated number.

The DOJ's new boss is carrying the (apparently unlit) torch for the FBI. He has demonized both end-to-end encryption and citizens who don't believe cops are blameless white knights standing between us and the collapse of civilization.

Now, he's moving the feds on to the next stage of grief: bargaining. A letter sent to Facebook -- sporting Barr's signature, along with other stalwart encryption foes like UK Home Dept. head Priti Patel and Australian MP Peter Dutton -- begs Facebook to please please please stop adding encryption to its services.

BuzzFeed obtained a draft report of the letter, which appears to be the charm offensive preceding the new US-UK data sharing agreement that targets encrypted communications. The letter contains some loaded language about child porn and its victims, suggesting Barr isn't done leaning on victimized children to advance his anti-encryption efforts. Hey, it didn't work for Comey, but maybe Bill Barr will get the horrific crime he needs to turn the public against their own best interests.

Here are some excerpts from the letter, as first published by BuzzFeed.

Dear Mr. Zuckerberg,

OPEN LETTER: FACEBOOK’S “PRIVACY FIRST” PROPOSALS

We are writing to request that Facebook does not proceed with its plan to implement end-to-end encryption across its messaging services without ensuring that there is no reduction to user safety and without including a means for lawful access to the content of communications to protect our citizens.

So, this is a request for a backdoor. (But one no government agency will refer to as a "backdoor.") "Lawful access" is law enforcement slang for "backdoor," kind of like "officer-involved shooting" is slang for "homicide" and "detected the odor of marijuana" is slang for "Fourth Amendment violation."

Barr (and his anti-encryption warriors) then attempt to call Zuck's bluff... um... I guess??

In your post of 6 March 2019, “A Privacy-Focused Vision for Social Networking,” you acknowledged that “there are real safety concerns to address before we can implement end-to-end encryption across all our messaging services.” You stated that “we have a responsibility to work with law enforcement and to help prevent” the use of Facebook for things like child sexual exploitation, terrorism, and extortion. We welcome this commitment to consultation. As you know, our governments have engaged with Facebook on this issue, and some of us have written to you to express our views. Unfortunately, Facebook has not committed to address our serious concerns about the impact its proposals could have on protecting our most vulnerable citizens.

And there it is. "Our most vulnerable citizens." Apparently that demographic group doesn't contain Facebook users. Facebook users will be fine, I guess, even if any number of malicious hackers/governments want access to communications no one on Facebook actually wants to share with them. "For the children" is the game here, and Barr forges forward with contradictory statements and terrible logic.

We support strong encryption, which is used by billions of people every day for services such as banking, commerce, and communications.

(But, pointedly, not Facebook communications.)

We also respect promises made by technology companies to protect users’ data. Law abiding citizens have a legitimate expectation that their privacy will be protected.

(Except from us.)

However, as your March blog post recognized, we must ensure that technology companies protect their users and others affected by their users’ online activities. Security enhancements to the virtual world should not make us more vulnerable in the physical world. We must find a way to balance the need to secure data with public safety and the need for law enforcement to access the information they need to safeguard the public, investigate crimes, and prevent future criminal activity. Not doing so hinders our law enforcement agencies’ ability to stop criminals and abusers in their tracks.

Ah, the famous tradeoff government officials always pitch, but one that isn't actually the tradeoff being made. It's not privacy vs. the security of the nation as a whole. It's personal security vs. government access that also grants access to criminals and state-sponsored hackers.

What people want is security. They're aren't really interested in trading security for government access. That does nothing for them. The government may solve a few more crimes, but the government was solving crimes long before cellphones, social media platforms, and end-to-end encryption.

Now, multiple governments feel they can't solve crimes without on-demand access to people's communications -- something they have never had in the history of crime-solving and communications. But here we are, listening to Barr and his buddies make a pitch for encryption backdoors while standing on the backs of child porn victims.

Barr makes this pitch while acknowledging that Facebook probably does far more than all US and UK law enforcement agencies combined to combat child porn.

Facebook currently undertakes significant work to identify and tackle the most serious illegal content and activity by enforcing your community standards. In 2018, Facebook made 16.8 million reports to the US National Center for Missing & Exploited Children (NCMEC) – more than 90% of the 18.4 million total reports that year. As well as child abuse imagery, these referrals include more than 8,000 reports related to attempts by offenders to meet children online and groom or entice them into sharing indecent imagery or meeting in real life. The UK National Crime Agency (NCA) estimates that, last year, NCMEC reporting from Facebook will have resulted in more than 2,500 arrests by UK law enforcement and almost 3,000 children safeguarded in the UK.

And yet, Barr wants to complain. Barr and his UK/Aussie counterparts want to claim this isn't enough. What's really needed is insecure communications on a platform used by billions. And to make this claim, Barr again points to something Facebook does as evidence that Facebook isn't doing enough.

While these statistics are remarkable, mere numbers cannot capture the significance of the harm to children. To take one example, Facebook sent a priority report to NCMEC, having identified a child who had sent self-produced child sexual abuse material to an adult male. Facebook located multiple chats between the two that indicated historical and ongoing sexual abuse. When investigators were able to locate and interview the child, she reported that the adult had sexually abused her hundreds of times over the course of four years, starting when she was 11. He also regularly demanded that she send him sexually explicit imagery of herself. The offender, who had held a position of trust with the child, was sentenced to 18 years in prison. Without the information from Facebook, abuse of this girl might be continuing to this day.

Here's what Barr thinks will happen if Facebook deploys end-to-end encryption. Facebook will no longer be able to "read" messages sent between users, which will result in an increase in abused children that authorities will be powerless to help.

Our understanding is that much of this activity, which is critical to protecting children and fighting terrorism, will no longer be possible if Facebook implements its proposals as planned. NCMEC estimates that 70% of Facebook’s reporting – 12 million reports globally – would be lost. This would significantly increase the risk of child sexual exploitation or other serious harms. You have said yourself that “we face an inherent tradeoff because we will never find all of the potential harm we do today when our security systems can see the messages themselves”. While this tradeoff has not been quantified, we are very concerned that the right balance is not being struck, which would make your platform an unsafe space, including for children.

"For children." That's the leverage. Barr wants Facebook to abandon its encryption plans to save children. Sure, that's admirable, if you're willing to overlook the considerable downside of creating a backdoor for governments or simply removing the encryption offer altogether. Facebook's encryption plans offer a whole new layer of security for lawful users -- some of which are targeted by authoritarian/corrupt governments. Many governments around the world pose as much of a threat to their citizens as criminals do. And a great many people believe their communications should be private, which means not being read/scanned by Facebook, much less any government that happens to stroll by waving some paperwork.

All Barr wants is for Facebook to abandon its encryption plans. He wants Facebook to be able to access the content of its users' messages. He wants every government in the world to be able to access the content of users' messages. He may only be aligned with three-fifths of the Five Eyes in this letter, but ensuring US/UK/Australian "lawful access" means giving every other two-bit dictatorship the same level of access to users' communications.

This isn't standard government bullshit. This is heinous, dangerous bullshit. This is a conglomerate of Western governments, on the eve of the deployment of a mysterious "data-sharing" agreement, portraying the implementation of encryption for communications as aiding and abetting the sexual abuse of children. This is a not-very-subtle smearing of every tech company that deploys encryption to protect its users from criminals and governments that behave like criminals. This is the abuse of the phrase "lawful access" to portray the possession of a warrant as a golden ticket to everything law enforcement wishes to obtain.

To be historically clear, a warrant has NEVER guaranteed access to communications. It has only allowed law enforcement to search for them. The implementation of encryption doesn't change this equation. But Barr and others keep pushing this in hopes of persuading the public -- and the tech companies they patronize -- that secret communications are something new and far more dangerous than anything law enforcement has ever encountered prior to the rise of social media and smartphones.

Filed Under: doj, encryption, mark zuckerberg, messenger, peter dutton, priti patel, privacy, security, snooping, william barr
Companies: facebook, instagram, whatsapp

DOJ Using The FOSTA Playbook To Attack Encryption

from the watch-out dept

For years now, the various DOJ folks pushing to break encryption have whined and complained that the tech industry won't even consider having an adult conversation about encryption. This, of course, has never been true. Indeed, in just the past few weeks we've highlighted two separate examples of attempts to bring together law enforcement folks and technology/cryptography experts to see if there are legitimate ways to move the conversation forward. That first one came up with an interesting and useful framework for judging any conversation about "lawful access" to encrypted communications, while the second demonstrated just how much various tech companies have been doing over the years -- in particular in helping law enforcement deal with the issue of child abuse.

And what do they get for all that? First, a horrific article in the NY Times that accurately highlights the awfulness of child sexual abuse online... but oddly frames the efforts that various tech companies have put into helping law enforcement as... evidence of not caring about the problem. And, of course, suggests that encryption is part of the problem:

After years of uneven monitoring of the material, several major tech companies, including Facebook and Google, stepped up surveillance of their platforms. In interviews, executives with some companies pointed to the voluntary monitoring and the spike in reports as indications of their commitment to addressing the problem.

But police records and emails, as well as interviews with nearly three dozen local, state and federal law enforcement officials, show that some tech companies still fall short. It can take weeks or months for them to respond to questions from the authorities, if they respond at all. Sometimes they respond only to say they have no records, even for reports they initiated.

And when tech companies cooperate fully, encryption and anonymization can create digital hiding places for perpetrators. Facebook announced in March plans to encrypt Messenger, which last year was responsible for nearly 12 million of the 18.4 million worldwide reports of child sexual abuse material, according to people familiar with the reports. Reports to the authorities typically contain more than one image, and last year encompassed the record 45 million photos and videos, according to the National Center for Missing and Exploited Children.

This is following the FOSTA/SESTA game plan. Highlight legitimately horrific examples of horrible things that people have done (in FOSTA's case, sex trafficking; here child porn). Then, follow it up by blaming the internet platforms and technology even if those platforms have actively helped law enforcement over and over again. Encryption is repeatedly suggested as truly evil.

Increasingly, criminals are using advanced technologies like encryption to stay ahead of the police.

"Advanced technologies"? And then:

Offenders can cover their tracks by connecting to virtual private networks, which mask their locations; deploying encryption techniques, which can hide their messages and make their hard drives impenetrable; and posting on the dark web, which is inaccessible to conventional browsers.

And again:

Tips included tutorials on how to encrypt and share material without being detected by the authorities.

Yes, encryption can be used to hide bad stuff. No doubt about it. However, it also protects the privacy and security of everyone else as well. There are real tradeoffs here to be discussed -- and we shouldn't forget that one element in that discussion is that law enforcement does have other tools to track down and find those involved in child porn. That encryption blocks some evidence does not mean there are not other ways for them to collect evidence -- as we've seen in many other cases.

But, given that Attorney General William Barr has been on an anti-encryption kick lately, as has FBI Director Chris Wray, it shouldn't be a huge surprise that they've teamed up for a DOJ "symposium" more or less building on the NY Times article (for which the DOJ appears to have been a major source), in which there appears to be an an entirely one-sided lineup of speakers to discuss the scary sounding:

Lawless Spaces: Warrant-Proof Encryption and Its Impact On Child Exploitation Cases

Barr is speaking, as is Wray. So is Deputy Attorney General Jeffrey Rosen, who also spent the summer trashing encryption. There are also two foreign speakers. There's Peter Dutton, the Home Affairs Minister from Australia, who lead that country's efforts to backdoor encryption with a bunch of ridiculously misleading claims about how companies that offer encryption should be blamed for anyone using it for illegal activity. Then there's the UK's Home Secretary, Priti Patel, who we had just mentioned earlier this week for her statements that encryption "empowers criminals."

There does not appear to be a single cryptographer on the program. There does not appear to be a single technologist on the program. There does not appear to be anyone who can provide even the slightest counterweight to the idea that encryption is just a tool for criminals. Contrast this to the sessions we talked about at the opening of this piece. The Carnegie Endowment and Stanford each actually invited people from a variety of different viewpoints and made sure to have actual experts involved. The DOJ is not doing that. This is pure theater as part of a public relations campaign to undermine the encryption that keeps us all safe.

Yes, you can point out very real and horrifying examples of people abusing just about any technology. But in a sane world, you then start looking at the actual size of the problem, the actual risks, the alternative approaches, and the costs and benefits associated with all of them. Not a single person on the DOJ's list of speakers seems equipped to do that. Given that we've quoted each and every one of them right here on Techdirt staking out an extreme anti-encryption standpoint over and over again, suggests that, unlike the tech industry, which has held and participated in various discussions, the DOJ just wants to set up scare mongering stories in the press before pushing for legislation that will destroy encryption and put us all at risk. For our safety.

As you'll recall, AG Barr himself had ominously warned that if the tech industry didn't "engage" then eventually there would be some sort of "incident" to "galvanize public opinion" against encryption:

Obviously, the Department would like to engage with the private sector in exploring solutions that will provide lawful access. While we remain open to a cooperative approach, the time to achieve that may be limited. Key countries, including important allies, have been moving toward legislative and regulatory solutions. I think it is prudent to anticipate that a major incident may well occur at any time that will galvanize public opinion on these issues.

Well, the industry was willing to engage and explain the costs of undermining encryption. But rather than understand that, it now looks like Barr is working overtime to manufacture that "major incident" to galvanize public opinion against their own security. It's a shame the NY Times decided to help.

Filed Under: child porn, chris wray, doj, encryption, fosta, going dark, moral panic, peter dutton, priti patel, william barr
Companies: facebook, google, ny times

No, The New Agreement To Share Data Between US And UK Law Enforcement Does Not Require Encryption Backdoors

from the sounds-messed-up-but-hardly-changes-anything dept

It's no secret many in the UK government want backdoored encryption. The UK wing of the Five Eyes surveillance conglomerate says the only thing that should be "absolute" is the government's access to communications. The long-gestating "Snooper's Charter" frequently contained language mandating "lawful access," the government's preferred nomenclature for encryption backdoors. And officials have, at various times, made unsupported statements about how no one really needs encryption, so maybe companies should just stop offering it.

What the UK government has in the works now won't mandate backdoors, but it appears to be a way to get its foot in the (back)door with the assistance of the US government. An agreement between the UK and the US -- possibly an offshoot of the Cloud Act -- would mandate the sharing of encrypted communications with UK law enforcement, as Bloomberg reports.

Social media platforms based in the U.S. including Facebook and WhatsApp will be forced to share users’ encrypted messages with British police under a new treaty between the two countries, according to a person familiar with the matter.

The accord, which is set to be signed by next month, will compel social media firms to share information to support investigations into individuals suspected of serious criminal offenses including terrorism and pedophilia, the person said.

The reporting here is borderline atrocious. The article insinuates that this agreement will force Facebook and WhatsApp to turn over decrypted communications or install a backdoor. It won't. The platforms may be compelled to turn over encrypted messages but all UK law enforcement will get is encrypted messages. The reporting here makes it appear as though social media platforms are being compelled to provide plaintext. They aren't.

Sharing information is fine. Social media companies have plenty of information. What they don't have is access to users' encrypted communications, at least in most cases. Signing an accord won't change that. There might be increased sharing of encrypted communications but it doesn't appear this agreement actually requires companies to decrypt communications or create backdoors.

Facebook has already issued a statement saying it opposes any plan that would require the creation of backdoors. It points out the Cloud Act does not mandate backdoors. While it does give the US government permission to engage in extraterritorial searches of US companies' data stores located overseas, it does not demand companies decrypt data or communications for it.

The other factor pointing in the direction of the UK law enforcement beneficiaries ending up with useless garbage is the Cloud Act itself. UK tech lawyer Graham Smith points out the Cloud Act requires agreements like these to be "encryption neutral," meaning neither side can mandate backdoors. Consequently, UK and US government agencies will get what they get when utilizing this new agreement. This means in some cases demands for data and communications will produce incomprehensible text, rather than anything useful.

That said, the UK government dream of encryption backdoors hasn't died. The Bloomberg article quotes UK Home Secretary Priti Patel, who has previously claimed encryption "empowers criminals." This is pretty much the same thing her predecessor, Amber Rudd, said. The less-than-implicit suggestion is that companies providing encrypted communications to users are siding with criminals, rather than the forces of law and order. Any perceived benefits of secure communications apparently pale in comparison to the government's "right" to access the content of communications.

This new accord likely won't (and probably can't) mandate backdoors -- no matter how the Bloomberg article skews it. But an international partnership created solely for the purpose of accessing communications and data applies a lot more pressure than parallel efforts from both sides of the pond.

Filed Under: cloud act, data sharing, encryption, law enforcement, priti patel, uk, us
Companies: bloomberg, whatsapp

The FBI Tried To Get A Secure Phone Company To Create A Backdoor In Its Encrypted Network

from the more-holes-equals-less-jail dept

Not a great week for the FBI, encryption-wise. The same week it was revealed the FBI's encrypted communications system was cracked by the Russians, a report by Joseph Cox of Motherboard details the agency's failure to punch a hole in a phone company's encrypted network.

The phone company targeted by the feds was Phantom Secure, a device maker with a business model that revolved almost exclusively around making secure phones for criminals. Apparently the supplier of choice for the Sinola drug cartel, Phantom Secure had been under investigation for years when its owner was arrested in 2018.

These efforts were apparently made after the arrest of the head of the company, with the FBI pitching a major sentence reduction if Phantom Secure CEO Vincent Ramos built the agency a backdoor.

"He was given the opportunity to do significantly less time if he identified users or built in/gave backdoor access," one source who knows Ramos personally and has spoken with him about the issue after his arrest told Motherboard.

Other law enforcement officers who worked on the investigation said similar things. The FBI wanted a backdoor so it could go after Phantom's numerous criminal customers. Despite the pressure, it appears Ramos never gave the FBI what it wanted.

A third source told Motherboard "He never gave law enforcement a backdoor into Phantom Secure. He did not do that." When pressed on whether the FBI still asked for access, the source, who worked directly on the case, said, "Basically that's all I want to say. He did not give law enforcement a backdoor into Phantom Secure."

The DOJ's tradition of begging for backdoors was apparently part of this criminal investigation as well. Cox's report says the CEO didn't actually have the tech talent to create a backdoor so the FBI pushed him to talk one of his employees into crafting a hole in the Phantom's PGP-protected system. When your customers are drug cartels known for their viciousness, it's probably safer to take the extra years in an American prison, which appears to be what Ramos chose to do.

The arrest of Ramos gave the FBI some leverage but it still couldn't get the backdoor it wanted. And just because Phantom Secure ended up in the business of selling exclusively to criminal organizations doesn't mean that's the reason the company was created. As Cox notes, Phantom Secure started as a legit option for security-conscious customers. Unfortunately, it chose to pursue the criminal market when that appeared to be the more profitable sector.

While it may suck that the FBI it didn't get its backdoor, it probably works out better for cellphone users anywhere. Phantom Secure modified Blackberry devices with its own software to create an encrypted network. The creation of a backdoor into this network may have made it easier to exploit off-the-shelf Blackberry devices or other secure messaging services that use PGP to encrypt data. Assuming this backdoor would have been harmless just because it targeted known criminal users is the kind of assumption the FBI would love everyone to make. Let's not do it any favors.

Filed Under: backdoor, doj, encryption, fbi, phones, vincent ramos
Companies: phantom secure

Tech Companies Are Leading The Fight Against Child Porn While The FBI And DOJ Complain About Encryption Helping Child Abusers

from the get-a-clue-[cough]-gentlemen dept

We hear so much from law enforcement agencies about how much tech companies -- and their encryption offerings -- are turning America into a lawless frontier where the criminals always win and the cops are eternally hamstrung. We mainly hear this from two law enforcement agencies in particular: the FBI and the DOJ.

Local cops seem to be doing just fine, but outside of Manhattan blowhard/DA Cy Vance, everyone seems to feel a rising tech tide lifts all cop boats. But these agencies insist we're "going dark." And they insist tech companies are screwing both cops and the public by allowing users to protect their communications and devices from criminals and snoopers alike, even if it means things are ever-so-slightly more difficult for criminal investigators.

But these arguments are being made using facts not in evidence. Tech companies do care about crime, public safety, law enforcement's concerns, and the general insecurity of having devices filled with personal info being carried around by the vast majority of the American public. And tech companies are doing far more to address all of these concerns (rather than just the law enforcement concerns touted by the FBI, et al) than the federales are willing to admit.

First off, tech companies are engaging in the "adult conversation" about lawful access. They're just doing it in a way the government doesn't like. They're approaching this with caution and concern, while the FBI and DOJ dishonestly claim the only "real" solution is unfettered, on-demand access to devices and communications.

White papers have been written. Honest discussions have been had. But these are ignored because they don't offer the "absolutist" options federal agencies desire. It's the DOJ and FBI who are engaging in the equivalent of kicking and screaming while ignoring the real adults in the room.

More evidence that tech companies are doing more to help than to hurt is rolling in. Casey Newton reports for The Verge that the fight against child sexual abuse is being lead by tech companies, and that law enforcement agencies are the beneficiaries of their contributions.

An example from the National Center for Missing and Exploited Children drove the point home. The organization has long operated a tipline in which people can report coming across child pornography and other incidents of abuse. In the late 1990s, the tipline received 200 to 300 reports per week, said Michelle DeLaune, NCMEC’s chief operating officer. But as the internet gained adoption, and platforms began collaborating with the organization, reports to the tipline exploded. In 2018, NCMEC received more than 18 million reports of exploitative imagery.

Strikingly, 99 percent of those reports come directly from the tech platforms. Through the use of artificial intelligence, hashed images, and partnerships between companies, we’re now arguably much better informed about the scope and spread of these images — and are better equipped to catch abusers.

Notably, these reports originate from communications platforms the DOJ and FBI have complained about.

A Facebook executive says that the company bans a whopping 250,000 WhatsApp accounts a month for sharing child exploitation imagery.

The implication that tech companies are doing nothing to respond to and to prevent criminal activities are, to put it politely, horseshit. These federal agencies have a vested interest in portraying tech companies as villains presiding over an internet Wild West. They want favorable court precedent and legislation.

As tech companies appear villainous -- something not helped by their numerous appearances in front of Congressional committees -- all branches of the government are more likely to screw tech companies into behaving as extensions of the federal government. This screws users and customers as well as the companies they use, but no price is too high to pay… as long as it's paid by others.

Filed Under: backdoors, encryption, going dark, law enforcement

You'd Think The FBI Would Be More Sensitive To Protecting Encrypted Communications Now That We Know The Russians Cracked The FBI's Comms

from the guys,-encryption-matters dept

On Monday, Yahoo News had a bit of a new bombshell in revealing that the closures of various Russian compounds in the US, along with the expulsion of a bunch of Russian diplomats -- which many assumed had to do with alleged election interference -- may have actually been a lot more about the Russians breaching a key FBI encrypted communications system.

American officials discovered that the Russians had dramatically improved their ability to decrypt certain types of secure communications and had successfully tracked devices used by elite FBI surveillance teams. Officials also feared that the Russians may have devised other ways to monitor U.S. intelligence communications, including hacking into computers not connected to the internet. Senior FBI and CIA officials briefed congressional leaders on these issues as part of a wide-ranging examination on Capitol Hill of U.S. counterintelligence vulnerabilities.

These compromises, the full gravity of which became clear to U.S. officials in 2012, gave Russian spies in American cities including Washington, New York and San Francisco key insights into the location of undercover FBI surveillance teams, and likely the actual substance of FBI communications, according to former officials. They provided the Russians opportunities to potentially shake off FBI surveillance and communicate with sensitive human sources, check on remote recording devices and even gather intelligence on their FBI pursuers, the former officials said.

That all seems like a fairly big deal. And, it specifically targeted the FBI's encrypted communications phone system:

That effort compromised the encrypted radio systems used by the FBI’s mobile surveillance teams, which track the movements of Russian spies on American soil, according to more than half a dozen former senior intelligence and national security officials. Around the same time, Russian spies also compromised the FBI teams’ backup communications systems — cellphones outfitted with “push-to-talk” walkie-talkie capabilities. “This was something we took extremely seriously,” said a former senior counterintelligence official.

The Russian operation went beyond tracking the communications devices used by FBI surveillance teams, according to four former senior officials. Working out of secret “listening posts” housed in Russian diplomatic and other government-controlled facilities, the Russians were able to intercept, record and eventually crack the codes to FBI radio communications.

While this is all interesting in the "understanding what the latest spy v. spy fight is about," it's even more incredible in the context of the FBI still fighting to this day to weaken encryption for everyone else. The FBI, under both James Comey and Christopher Wray, have spent years trashing the idea that encrypted communications was important and repeatedly asking the tech industry to insert deliberate vulnerabilities in order to allow US officials to have easier access to encrypted communications. The pushback on this, over and over, is that any such system for "lawful access" will inevitably lead to much greater risk of others being able to hack in as well.

Given that, you'd think that the FBI would be especially sensitive to this risk, now that we know the Russians appear to have cracked at least two of the FBI's encrypted communications systems. Indeed, back in 2015, we highlighted how the FBI used to recommend that citizens use encryption to protect their mobile phones, but they had quietly removed that recommendation right around the time Comey started playing up the "going dark" nonsense.

Of course, it's possible that the folks dealing with the Russians cracking FBI encrypted comms are separate from the people freaking out about consumer use of encryption, but the leadership (i.e., Comey and Wray) certainly had to understand both sides of this. This leaves me all a bit perplexed. Were Comey and Wray so completely clueless that they didn't think these two situations had anything to do with one another? Or does it mean that they thought "hey, if we had our comms exposed, so should everyone else?" Or do they just not care?

Filed Under: communications, doj, encryption, fbi, going dark, protected communications, russia, russians

Encryption Working Group Releases Paper To 'Move The Conversation Forward'

from the what-conversation? dept

One of the frustrating aspects of the "debate" (if you can call it that) over encryption and whether or not law enforcement should be able to have any kind of "access" is that it's been no debate at all. You have people who understand encryption who keep pointing out that what is being asked of them is impossible to do without jeopardizing some fairly fundamental security principles, and then a bunch of folks who respond with "well, just nerd harder." There have been a few people who have suggested, at the very least, that "a conversation" was necessary between the different viewpoints, but mostly when that's brought up it has meant non-technical law enforcement folks lecturing tech folks on why "lawful access" to encryption is necessary.

However, it appears that the folks at the Carnegie Endowment put together an actual working group of experts with very varying viewpoints to see if there was any sort of consensus or any way to move an actual conversation forward. I know or have met nearly everyone on the working group, and it's an impressive group of very smart, and thoughtful people -- even those I frequently disagree with. It's a really good group and the paper they've now come out with is well worth reading. I don't know that it actually moves the conversation "forward" because, again, I'm not sure there is any conversation to move forward. But I do appreciate that it got past the usual talking points. The paper kicks off by saying that it's going to "reject two straw men," which are basically the two positions frequently stated regarding law enforcement access to encrypted communication:

First of all, we reject two straw men—absolutist positions not actually held by serious participants, but sometimes used as caricatures of opponents—(1) that we should stop seeking approaches to enable access to encrypted information; or (2) that law enforcement will be unable to protect the public unless it can obtain access to all encrypted data through lawful process. We believe it is time to abandon these and other such straw men.

And... that's fine, in that the first of those statements is not actually the position those who support strong encryption actually hold. I mean, there have been multiple reports detailing how we're actually in the "golden age of surveillance", and that law enforcement has so much greater access to basically every bit of communications possible, and that there are plenty of tools and ways to get information that is otherwise encrypted. Yes, it's true that some information might remain encrypted, but no one has said that law enforcement shouldn't do their basic detective work in trying to access information. The argument is just that they shouldn't undermine the basic encryption that protects us all to do so.

Where the paper gets perhaps more interesting is that it suggests that any debate about access to encrypted data should focus on "data at rest" (i.e., data that is encrypted on a device) rather than "data in motion" which is the data that is being transferred across a network or between devices in some form. The paper does not say that we should poke holes in encryption that protects data at rest, and says, explicitly:

We have not concluded that any existing proposal in this area is viable, that any future such proposals will ultimately prove viable, or that policy changes are advisable at this time

However, it does note that if there is a fruitful conversation on this topic, it's likely to be around data at rest, rather than elsewhere. And, from there it notes that any discussion of proposals for accessing such data at rest must take into account both the costs and the benefits of such access to determine if it is viable. While some of us strongly believe that there is unlikely to ever be a proposal where the costs don't massively outweigh the benefits, this is the correct framework for analyzing theses things. And it should be noted that, too often, these debates involve one group only talking about the benefits and another only talking about the costs. Having a fruitful discussion requires being willing to measure both.

From there, the group sets up a framework for how to weigh those costs and benefits -- including setting up a bunch of use cases against which any proposal should be tested. Again, this seems like the right approach to systematically exploring and stress testing any idea brought forth that claims it will "solve" the "problem" that some in law enforcement insist encryption has created for them. I am extremely skeptical that any such proposal can pass such a stress test in a manner that suggests that the benefits outweigh the costs -- but if those pushing to undermine encryption require a "conversation" and want people to explore the few proposals that have been brought up, this is the proper, and rigorous, way to do so.

The question, though, remains as to whether or not this will actually "move the conversation forward." I have my doubts on that, in part because those who keep pressing for undermining encryption have never appeared to have much interest in actually having this type of conversation. They have mostly only seemed interested in the "nerd harder, nerds" approach to this, that assumes smart techies will give them their magic key without undermining everything else that keeps us secure. I fully expect that it won't be long before a Willam Barr or Chris Wray or a Richard Burr or a Cy Vance starts talking nonsense again about "going dark" or "responsible encryption" and ignores the framework set out by this working group.

That's not so say this wasn't a useful exercise. It likely was, if only to be able to point to it the next time one of the folks listed above spout off again as if there are no tradeoffs and as if it's somehow easy to solve the "encryption problem" as they see it.

Filed Under: data at rest, encryption, going dark, law enforcement, nerd harder, responsible encryption

Just As Attorney General Barr Insists iPhone Users Have Too Much Security, We Learn They Don't Have Nearly Enough

from the well,-look-at-that dept

You may recall a few years back, John Oliver did one of his always excellent Last Week Tonight shows all about encryption. It concluded with an "honest Apple commercial" that highlighted the difficulty of keeping phones secure, and noting that it's a constant war against malicious attackers who are always trying to figure out new ways to break into people's phones:

That commercial is a lot more realistic than people might think. And late last week, Google revealed a pretty astounding iOS exploit that broadly targeted anyone who visited a series of compromised websites, using a combination of zero day attacks that allowed them to more or less own anyone's iPhone who had visited the sites. As Wired noted in its piece about this attack, it changes most of what we know about iPhone attacks these days. At the very least, it demolished the idea that most iPhone hacking really only targeted key individuals.

It also represents a deep shift in how the security community thinks about rare zero-day attacks and the economics of "targeted" hacking. The campaign should dispel the notion, writes Google Project Zero researcher Ian Beer, that every iPhone hacking victim is a "million dollar dissident," a nickname given to now-imprisoned UAE human rights activist Ahmed Mansour in 2016 after his iPhone was hacked. Since an iPhone hacking technique was estimated at the time to cost $1 million or more—as much as $2 million today, according to some published prices—attacks against dissidents like Mansour were thought to be expensive, stealthy, and highly focused as a rule.

The iPhone-hacking campaign Google uncovered upends those assumptions. If a hacking operation is brazen enough to indiscriminately hack thousands of phones, iPhone hacking isn't all that expensive, says Cooper Quintin, a security researcher with the Electronic Frontier Foundation's Threat Lab.

"The prevailing wisdom and math has been incorrect," says Quintin, who focuses on state-sponsored hacking that targets activists and journalists. "We've sort of been operating on this framework, that it costs a million dollars to hack the dissident’s iPhone. It actually costs far less than that per dissident if you’re attacking a group. If your target is an entire class of people and you're willing to do a watering hole attack, the per-dissident price can be very cheap."

Now, it's true that device encryption has nothing to do with this attack -- and, in fact, the attack could be seen as a way to get around device encryption, since it was putting malware on your phone that could slurp up your data once you unencrypted it locally -- but it does strike me as yet another condemnation of Attorney General William Barr's utter nonsense lately about how the average consumer doesn't need that much phone security these days. If you'll recall, Barr shrugged off concerns about banning real encryption by saying that since all phones have some security vulnerabilities, what's a few more:

All systems fall short of optimality and have some residual risk of vulnerability — a point which the tech community acknowledges when they propose that law enforcement can satisfy its requirements by exploiting vulnerabilities in their products. The real question is whether the residual risk of vulnerability resulting from incorporating a lawful access mechanism is materially greater than those already in the unmodified product. The Department does not believe this can be demonstrated.

The Department of Justice and Barr are wrong. Encryption still remains not just a key piece of fighting these vulnerabilities, but one of the most important. Creating "lawful access" points is worse than taking away a protection, it's literally enabling a multitude of new vulnerabilities -- and playing right into the hands of people looking to exploit such vulnerabilities.

Indeed, as the Wired article notes, even as surprising and unexpected as the latest vulnerabilities were, it's notable that they appeared to be out there for quite some time, with many, many victims, and no one spotted it even though the attackers were super sloppy:

The hackers still made some strangely amateurish mistakes, Williams points out, making it all the more extraordinary that they operated so long without being detected. The spyware the hackers installed with their zero-day tools didn't use HTTPS encryption, allowing anyone on the same network as a victim to read or intercept the data it stole in transit. And that data was siphoned off to a server whose IP addresses were hardcoded into the malware, making it far easier to locate the group's servers, and harder for them to adapt their infrastructure over time. (Google carefully left those IP addresses out of its report.)

Given the mismatch between crude spyware and highly sophisticated zero-day chains used to plant it, Williams hypothesizes that the hackers may be a government agency that bought the zero day exploits from a contractor, but whose own inexperienced programmers coded the malware left behind on targeted iPhones. "This is someone with a ton of money and horrible tradecraft, because they’re relatively young at this game," Williams says.

And that certainly suggests that there are likely already much more sophisticated attacks out there -- and if not, many more are coming soon. And, they will target any and all possible vulnerabilities -- including any "backdoor" the DOJ/FBI demands that device makers install. Contrary to what you may have heard that the debate over backdoors is a fight between 'security and privacy," it's not. It's a debate between "security for most people, and rare instances where law enforcement doesn't want to do basic detective work and wants everything handed to them."

This latest revelation should now make many people more aware of the security challenges of protecting connected devices. But it should also re-emphasize how utterly ludicrous it would be to purposefully insert new vulnerabilities into phones because the DOJ can't be bothered to do its job properly.

Filed Under: encryption, hacks, iphone security, iphones, security, william barr, zero days
Companies: apple, google