Why Do Josh Hawley's Cures For 'Big Tech' Always Oddly Omit 'Big Telecom'?

from the half-the-battle dept

Over the last year, giants like Amazon, Facebook, Google, and Apple have all faced growing calls for greater regulatory oversight and antitrust enforcement, something that isn't particularly surprising. After all, experts have noted for decades that US antitrust enforcement has grown toothless and frail, and our definitions of monopoly power need updating in the Amazon era. Facebook's repeated face plants on privacy (and basic transparency and integrity) have only added fuel to the fire amidst calls to regulate "big tech."

But while Silicon Valley giants now face an endless cavalcade of outrage in DC, the telecom sector is suddenly seeing no scrutiny whatsoever. Whether it's the speed at which the problematic T-Mobile merger is being shoveled through the DOJ and FCC, or the blind eye being turned to major telecom privacy scandals (like location data), telecom lobbyists have been on a successful tear convincing well-heeled DC lawmakers to ignore the massive, obvious monopoly, privacy, and competition issues inherent in telecom to focus exclusively on the problems in "big tech."

This crusade against "big tech" has seen no shortage of advocates who've historically been absent on glaring and painful monopoly and consumer protection issues in other sectors. Like Marsha Blackburn, who has rubber stamped every fleeting monopolistic and privacy-violating whim AT&T executives have ever had, yet is now branding herself as some sort of consumer advocacy and privacy expert as she rails against "big tech."

Another major voice in the "battle to fix 'big tech'" has been Josh Hawley, who has been endlessly vocal about the issues with big tech, but just as absent as Blackburn when it comes to criticizing the same exact problems plaguing the telecom sector. Last week, Hawley unveiled a plan to fix the FTC (pdf) -- an agency, he correctly notes, that has been largely feckless when it comes to reining in the bad behavior of lumbering giants like Facebook:

"As it stands today, the FTC lacks teeth. Its jurisdiction is divided. It wastes time in turf wars with the Department of Justice (DOJ) while failing to confront the increasing concentration in our economy, in the tech sector most obviously. And it is woefully unaccountable. The agency as presently constituted is in no shape to ensure competition in today’s markets, let alone tomorrow’s."

He's certainly not wrong on that. If anything, he undersells the problem. The FTC has somewhere around 8% of the staff focused on resolving privacy issues as its counterpart in the UK, despite the UK having a fifth as many people as the US. The FTC is also a cesspool of revolving door conflicts, with most employees having either recently left the companies they're supposed to hold accountable, or simply biding their time until they can go lobby for those same companies. And, like the FCC, its partisan majority makeup results in whiplash as the parties jerk the reins of policy from one side of the spectrum to the other.

This is not some inadvertent error. An understaffed, underpowered FTC is the intentional lobbying byproduct of giant U.S. companies that don't find taxpayer or regulatory accountability particularly exciting. It's why even when the FTC finally acts on an issue, its solutions (as we saw with Equifax or Facebook) are pathetic messes that in no way deter future bad behavior (and in some ways only encourage the problems to repeat themselves). It's a feature, not a bug.

Hawley's cure for this involves essentially gutting the agency as it stands, then rolling it into the DOJ to provide "clear and direct oversight." His effort would also eliminate the FTC’s five-member structure, which, like the FCC, is based on a partisan 3-2 split depending which party holds the Presidency. Instead, the FTC boss would fall under the authority of a Senate-confirmed single director serving a five-year term.

There's stuff under Hawley's plan that's certainly common sense -- stricter controls on ethics, antitrust enforcement being centralized, etc. The problem is several fold. For one, do we really want ex-Verizon lawyer Bill Barr in charge of the FTC? Couldn't giving that kind of leverage to Barr only aid his relentless effort to break encryption and put backdoors into, well, everything? Meanwhile, the partisan FTC strife Hawley claims to be eliminating would probably just jump over to the confirmation hearing process, and the numerous hearings and laws you'd likely need to make his plan a reality.

The other big problem: a lot of these regulatory "modernization" plans often wind up being little more than exercises in butchery dressed up as reform once they actually materialize in the wild.

Case in point: with its recent net neutrality repeal, the FCC recently neutered its authority over telecom providers at telecom lobbyist behest amidst claims it would create "internet freedom" and spur investment (neither happened). But contrary to public wisdom, the repeal didn't just kill net neutrality. It effectively gutted the FCC, shoveling much of its responsibilities over to the FTC -- an agency that lacks the authority or resources to actually police the telecom sector. This was, in case you're a little slow, the entire reason the telecom lobby pushed for it. It wanted consumer protection and accountability to fall into a deep, dark chasm. It's working, and a lot of blatant efforts by telecom to rip users off or violate their privacy have gone utterly unpunished amidst crickets from "big tech" reformers.

Gutting already shaky oversight is not really "reform," and I'm curious what happens to telecom oversight if we destroy the existing FTC and hand management of the telecom sector over to Bill Barr. Former Verizon lawyers would be running both the FCC and FTC, and both consumer protection and antitrust enforcement would fall to a duo who've shown less than zero interest in reining in AT&T, Verizon and Comcast, or the trio's thirty year track record of aggressively anti-consumer, anti-innovation, and anti-competitive behavior. Behavior that was being bone-grafted to the American institution while Google and Facebook were still just twinkles in youngsters' eyes.

One might feel better about this if the perils of telecom monopolies weren't so utterly absent from Hawley's rhetoric. When you dig through his plan or his lengthy treatises on reform over at his website or in speeches, big telecom is almost never mentioned -- despite the sector engaging in many of the same, or worse behaviors. Much like Blackburn, Hawley appears to have placed the entire onus for the modern internet's ills securely on the back of big tech, while giving telecom a free pass. Why do you think that is, exactly?

There are certainly plenty of reasons to criticize big tech giants like Facebook, whose face plants on privacy are now the stuff of legend. But big telecom is every bit as bad as big tech. As government-pampered giants that also enjoy unaccountable monopolies over internet access itself, in some ways the sector is arguably worse.

AT&T's massive ad ambitions rival anything Silicon Valley ever concocted, fusing television, mobile, location, and countless other data sources into what The Verge recently called an "ad tracking nightmare hellworld." From Verizon getting busted for covertly modifying user packets to track you around the internet to recent location data scandals, the sector's just as terrible on privacy as anything Silicon Valley has to offer. This is before you even mention that they're enthusiastically bone-grafted to the NSA.

As companies like Comcast NBC Universal and AT&T Time Warner increasingly push into the ad tech space, they've been eagerly pushing a crackdown on the big tech giants whose market share they hope to erode. Any quest to fix the US' broken antitrust and consumer protection enforcement has to take a bigger picture view that identifies both big tech and big telecom monopolies as part of the same giant problem.

Politicians that fixate exclusively on the former are either being painfully but genuinely myopic, or they're exhibiting a byproduct of relentless lobbying by the telecom sector, which has been pushing for this special brand of asymmetrical "reform" for several years now.

Filed Under: antitrust, big tech, competition, doj, ftc, internet, josh hawley, law enforcement, privacy, telecom

China's To Blame For The Equifax Hack. But It Shouldn't Let Equifax, Or US Regulators, Off The Hook.

from the plenty-of-blame-to-go-around dept

The Department of Justice this morning formally announced that it has identified the Chinese government as the culprit behind the historic Equifax hack. If you've forgotten, the 2017 hack involved hackers making off with the personal financial data of more than 147 million Americans. Those victims were then forced to stumble through an embarrassing FTC settlement that promised them all manner of financial compensation that mysteriously evaporated once they went to collect it.

According to the FTC's press release and the indictment (pdf), the four Chinese government employees responsible for the hack were all members of the People’s Liberation Army's 54th Research Institute, an extension of the Chinese military. The four exploited a vulnerability in the Apache Struts Web Framework software used by Equifax’s online dispute portal to first gain access to Equifax's systems, then ran more than 9,000 queries before managing to offload both consumer financial data and "proprietary Equifax info" (mostly related to databases) to a Dutch server.

In a statement, Equifax was happy to see the onus shifted entirely onto the backs of the Chinese:

"Cybercrime is one of the greatest threats facing our nation today, and it is an ongoing battle that every company will continue to face as attackers grow more sophisticated. Combating this challenge from well-financed nation-state actors that operate outside the rule of law is increasingly difficult. Fighting this cyberwar will require the type of open cooperation and partnership between government, law enforcement and private business that we have experienced firsthand."

That rhetoric was mirrored in the DOJ's announcement and Bill Barr's speech, which repeatedly framed the entire Equifax saga as largely a victory for U.S. national security:

"The size and scope of this investigation — affecting nearly half of the U.S. population, demonstrates the importance of the FBI’s mission and our enduring partnerships with the Justice Department and the U.S. Attorney’s Office. This is not the end of our investigation; to all who seek to disrupt the safety, security and confidence of the global citizenry in this digitally connected world, this is a day of reckoning."

Except there are a few things both Equifax and Bill Barr forget to mention. One, the vulnerability that allowed the hackers to gain access to this data was known about by Equifax months before the attack and the company did nothing about it. Two, that this data wouldn't be available to steal if companies like Equifax hadn't made an industry out of collecting this sort of data -- without consumer consent and with no way for consumers to opt out -- in the process creating such a delicious target. A target they then failed to adequately secure and protect.

So yes, while it's certainly great we've identified the hackers (who'll never see the inside of a jail cell), this entire mess could have been avoided.

A few lawmakers, like Senator Mark Warner, were quick to applaud the investigation while highlighting how it shouldn't distract from Equifax's failures:

"The indictment does not detract from the myriad of vulnerabilities and process deficiencies that we saw in Equifax’s systems and response to the hack,” Senator Mark Warner said in a statement provided to Motherboard. “A company in the business of collecting and retaining massive amounts of Americans’ sensitive personal information must act with the utmost care – and face any consequences that arise from that failure."

Another thing neither Equifax or Bill Barr likely want to highlight is that the penalty for Equifax -- and the FTC settlement for consumers -- was little more than a cruel joke. While the $575 million FTC settlement was bandied about for being a "record" deal, like most hack/breaches, the final penalty was a far cry from the money made from collecting and selling access to this data for decades. And the consumer "compensation" aspect of the deal involved both useless "free" credit reporting software and $125 cash payouts that mysteriously disappeared when victims went to collect them, adding insult to injury.

A lack of any meaningful US privacy law for the internet era means there's repeatedly no real punishment for companies that fail to secure the vast troves of data they're now collecting on your every waking moment. Nor is there any real compensation for consumers who may not have wanted this data collected, stored, and sold to every nitwit with a nickel. There are so many points of failure here -- from corporations that treat privacy and security as an afterthought to captured regulators too feckless to do anything about it -- that focusing too extensively on national security risks us learning absolutely nothing from the experience.

Filed Under: china, cybersecurity, data breach, doj, security, william barr
Companies: equifax

How Attorney General Barr's War On Encryption Will Harm Our Military

from the stop-it-guys dept

We've highlighted in the past that there are large parts of the federal government that recognize that strong encryption is actually very, very important for national security, and that the framing by Attorney General William Barr, FBI Director Christopher Wray, and even President Trump -- that there need to be back doors to encryption for "security" reasons -- is utter nonsense. The intelligence community has long recognized the importance of strong encryption. Even many people within the FBI think their bosses' position on this issue is bonkers. Late last year, we were pleasantly surprised to see the Defense Department step up as well, with a letter to Congress talking about just how important encryption is for national security.

Over at Cyberscoop, former National Security Council cybersecurity expert Ari Schwartz has a nice article explaining just how important encryption is to protecting the military. It won't tread any new ground for anyone who understands the basics here, but it's nice to see more and more people highlighting this.

Last month, a brigade of U.S. soldiers deployed to the Middle East received instructions from their superiors to use two commercial encrypted messaging applications, Signal and Wickr, on their government issued cell phones. These leadership cues trickled down from the Department of Defense’s (DoD) position that strong encryption is critical to national security. While U.S. Attorney General William Barr continues to push for a broad mandate for backdoors for law enforcement, those on the front lines of protecting America have notably decided on a different approach. Simply put, weakening encryption means putting our military service members at risk.

The key point -- and one that many of us have made for years is that the framing by Wray/Barr (and, for what it's worth, James Comey before them) is that there's some sort of conflict here between "security" and "privacy." But that's always been bullshit. The issue has always been between having both security and privacy vs. giving law enforcement easier access to data and information they can almost always get elsewhere with a little more effort. In short, it's a debate between having security and privacy widely available against a bit of convenience for law enforcement. As such, this should be no debate at all.

Let’s stop wasting time suggesting that we need universal solutions that may solve law enforcement’s short-term needs, but then put consumers and our military at risk.

Somehow, I don't think the time wasting is going to go away any time soon, unfortunately.

Filed Under: dod, doj, encryption, going dark, military, national security, william barr

Puerto Rico's Justice Department Demanded Info From Facebook About Journalists Who Livestreamed Protests

from the not-how-that-works dept

Historically, the DOJ hasn't really let the First Amendment stand in the way of its investigations. In very recent history, the FBI has targeted journalists to hunt down leakers, and has impersonated journalists during investigations. While the DOJ and FBI have dealt with some limited repercussions due to their targeting of First Amendment activities (which includes targeting Muslims because they're Muslims), it really hasn't promised to stop doing this. Nor has it been told to stop doing this. Instead, the DOJ has simply made it slightly more difficult for investigators to violate people's rights.

The Intercept has done some investigating of its own and discovered the FBI actively engaged in First Amendment violations for years during its partnership with Puerto Rican law enforcement agencies.

For decades, Puerto Rico’s police department operated an intelligence unit dedicated to spying on dissidents. With the knowledge of the FBI, police officers created a file, known as a carpeta, for anyone who could be construed as a supporter of Puerto Rican independence or other environmental or labor causes. Officers recruited neighbors, friends, and relatives to collect information about those targeted, and planted rumors that led to divorce, job loss, and irreparable discord within communities and families.

75,000 of these files were created. This secret surveillance was finally revealed in 1987 and was ruled unconstitutional in 1988 by a Puerto Rican court. That should have ended it. Instead, the surveillance of First Amendment-protected activities is alive and well, headed by the island's Justice Department. Seven students are facing charges related to a nonviolent anti-austerity protest held in 2017. To locate the suspects it wanted to charge, the Justice Department targeted the student publications that streamed footage of the demonstration.

The documents released to defense attorneys provide... evidence of a broad and invasive hunt for prosecutable crimes related to the protests. An agent from the cybercrimes unit of Puerto Rico’s Justice Department sought a search warrant for the records of virtually every Facebook interaction over a 72-hour period with the three publications that livestreamed the protest. The agent obtained private messages with the publications’ followers and detailed information about the student journalists who managed the pages.

The warrant demanded everything. It asked Facebook to hand over searches performed by page administrators, any content that had been deleted, GPS coordinates for posts, IMSI numbers from associated phones, and billing records. The agent working for the Justice Department claimed this was a normal thing to do during an investigation of an incident where no one was arrested, saying all this was needed to collect "evidence" of supposed criminal activity.

Again, the protest being investigated resulted in only a small amount of property damage and zero arrests. Only in hindsight did Puerto Rican law enforcement decide some people needed to be prosecuted and, bizarrely, decided to start this investigation by demanding information about journalists who did nothing more than record the demonstration.

Unfortunately, this sort of thing seems to be increasing, rather than being relegated to law enforcement agencies' pasts. The protests that greeted Trump's inauguration did result in property damage and violence, but the investigation started with broad demands for data on the 1.2 million visitors to a protest group's website.

This investigation also involved a protest, one that lasted only a half-hour, and resulted in a broken glass door and some damaged furniture. This led to an investigation where 1,553 pages of information about student journalists were handed over to the Justice Department by Facebook. And for what? To investigate people who weren't even participating in the protest? To give the government evidence it doesn't even appear to be interested in using in this case?

Collateral damage to rights is something to be taken seriously. Targeting one First Amendment activity (protesting) through the Facebook pages of another First Amendment activity (journalism) is pretty much the worst way to investigate anything. In this case, the obvious problems were made worse by the government's inability (or unwillingness) to narrow the scope of data demands. And the demand for info should never have been approved by any level of oversight (judicial or otherwise) without more restrictions being put in place.

Filed Under: 1st amendment, doj, fbi, investigations, journalism, privacy, protests, puerto rico, surveillance
Companies: facebook

Is William Barr's Latest Attack On Section 230 Simply An Effort To Harm Tech Companies For Blocking His Desire To Kill Encryption?

from the this-makes-no-sense dept

Last month, we noted that Attorney General William Barr was making a bizarre attack on Section 230 of the Communications Decency Act, claiming that the DOJ was "studying Section 230 and its scope" and arguing -- without evidence -- that 230 might be contributing to "unlawful behavior" online. As we noted at the time, Section 230 explicitly exempts federal criminal charges from what it applies to, meaning that it literally cannot interfere with any DOJ prosecution. So it's truly bizarre to see the DOJ concerned about the issue.

But Barr has continued to push forward with this anti-230 kick, and is going to host a "workshop" about 230 in a few weeks.

The U.S. Justice Department is hosting a workshop next month seeking “a wide diversity of viewpoints” on Section 230 of the Communications Decency Act, the federal statute that, with few exceptions, protections major internet companies and private website owners from liability when it comes to the posts and comments generated by users.

While the DOJ claims that this workshop will have that "diversity of viewpoints," as we've seen in other contexts with the DOJ, that this is rarely the actual case. It may offer up a sacrificial lamb in support of 230, but it is likely to stack the deck against 230. This is the same thing that the DOJ has done, repeatedly, with regard to the encryption debate and questions around "going dark." Indeed, we've noted before the similarities between the government's efforts to attack encryption and the playbook that was used to attack Section 230 in 2018. In fact, we've heard that the very same former Hollywood lobbyist is a key player in both efforts.

Given the similarities in the playbook, and the fact that the DOJ is not hindered at all by 230, it makes you wonder if Barr and the DOJ are playing this anti-230 card simply as a method of punishing the internet industry for opposing his desire to gut encryption? The whole thing seems to be little more than an abuse of DOJ power to intimidate and threaten an entire industry for daring to support online security and free speech online against a government which would prefer neither thing be enabled.

Filed Under: cda 230, doj, encryption, section 230, william barr

FISA Court Orders FBI To Start Cleaning Up Its Carter Page Surveillance Mess

from the fool-me-a-dozen-or-more-times,-here's-another-angry-court-order dept

The FBI's abuse of its surveillance powers in the Carter Page investigation -- uncovered by the Inspector General -- is now being addressed by the FISA court. The FISA court is often considered to be a rubber stamp for government applications -- only very rarely rejecting the government's national security advances.

Some of this is due to deference the government very definitely hasn't earned. But some of this is due to the FISA court flying blind. The government still keeps secrets from the nation's most secretive court and judges are forced to accept its assertions because they don't possess the information needed to push back against the government's claims.

The Inspector General's report highlighted more abuses by the FBI during its investigation of former Trump campaign advisor, Carter Page. The IG found the FBI had omitted info that likely would have seen its applications denied, most notably knowledge it had obtained from its sources that Carter Page most likely wasn't acting as an agent of a foreign power.

The first application made to the court in October 2016 was probably legitimate. The other two applications seeking to continue surveillance of Page weren't. Had the FBI been honest in its applications, the two extensions would likely have been rejected by the FISA court.

With this info in hand, the FISA court is moving forward with another attempt to keep the FBI from abusing its national security privileges. We'll see if it works. So far, nothing has permanently prevented any agency with access to the FISA court from abusing its surveillance powers.

The corrective actions began with a December 2019 order that demanded the FBI identify any other matters before the court that involved FBI lawyer Kevin Clinesmith. Clinesmith altered an email from another US government agency to hide the fact that Page was a government source for this agency. The FBI lawyer has since resigned and been referred to the DOJ for criminal charges.

The latest order [PDF] is another rarity for the FISA court, but sketchy times call for greater transparency. If the FBI doesn't want its dirty laundry aired publicly by the secret court, perhaps it shouldn't create so much of it. Very few orders have been released by the FISA court without a (regular) court battle, so the FISA court's proactiveness is still very much an anomaly.

The order makes more demands of the FBI. The court wants to know how the agency is going to make things right. In reference to the Carter Page surveillance applications, the court demands the FBI to explain how it's going to "sequester" everything the FBI collected on/from Carter Page using its bogus applications.

It also wants a detailed description of what the FBI/DOJ is doing to restrict access to unminimized US person info gathered during the Carter Page investigation, as well any restrictions it has placed on access/dissemination of info on Page it never should have collected, much less distributed in the first place.

The Intelligence Community's string of surveillance abuses remains unbroken. Because the FISA court is only barely adversarial, the government is able to run its bullshit pretty much uncontested. Once again, it took outside help -- namely, the Inspector General's office -- to show the court what the FBI was really doing. The only question is how often the court is willing to get burnt by its untrustworthy patrons.

Filed Under: carter page, doj, fbi, fisa, fisa court, fisc, inspector general, transparency

Attorney General Barr's Anti-Encryption Efforts Aren't Supported By Many FBI Officials

from the going-to-war-with-the-one-many-army-you-have dept

When Attorney General William Barr speaks, he represents the DOJ and all the agencies it oversees. The problem is that Bill Barr's recent anti-encryption agitating doesn't reflect the views of the people he oversees. While Barr is trying to turn the public against Apple by suggesting it protects terrorists and murderers, FBI employees are worried his words and actions will harm them more than help them.

The Wall Street Journal spoke to people in the FBI and DOJ who aren't convinced Barr's doing the right thing by taking a hardline stance on encryption. [Non-paywalled version here.]

Some senior FBI officials say privately they are worried that Mr. Barr’s sharp tone could undermine relationships with technology companies they have worked hard to develop, people familiar with the matter said.

The bureau relies on close partnerships with tech firms in a range of investigations, with companies complying with legal requests for data and troubleshooting technical obstacles that agents may struggle with, current and former officials said.

Pushing Apple is unproductive. It damages relationships while gaining absolutely nothing for the DOJ and FBI. Apple has already given the FBI all the information it can pull from the Pensacola shooters' accounts. Breaking encryption simply isn't an option -- not when it leads directly to reduced security for the rest of Apple's customers.

Many in the FBI realize this. Barr just doesn't seem to care. If Barr continues to push his anti-encryption agenda, he not only risks reducing cooperation from tech companies but also the trust of the people who work for him. Barr says Apple's not doing enough to help investigations. Internally, the FBI disagrees.

Some FBI officials were stunned by Mr. Barr’s rebuke of Apple, the people familiar with the matter said, and believe the Pensacola case is the wrong one to press in the encryption fight, in part because they believed Apple had already provided ample assistance to the probe.

Barr's ultimate goal may be another courtroom showdown. Others in the FBI would prefer precedent to outside help from phone-cracking companies. Barr has aligned himself with those officials. But the ones pushing for precedent seem unaware of how much collateral damage the FBI itself might suffer if things don't work out the way Barr wants them to.

[Former DHS Secretary Michael] Chertoff said a court ruling against the Justice Department could limit access to widely available forensic tools that allow investigators to get into phones in some situations, for instance. “It’s not clear to me why this fight is advantageous to anybody,” he said.

Barr and those like them so firmly believe they're in the right, they're seemingly incapable of considering the negative consequences of their actions. Precedent that safeguards people's phones against encryption-breaking efforts works against the government, restricting its access to outside assistance. But even if the FBI gets the precedent it wants, the nation as a whole will be less secure because encryption will be compromised severely and permanently. Barr and his anti-encryption buddies are willing to sacrifice everyone else's security for their own ends. That's not just selfish. It's also dangerous.

Filed Under: doj, encryption, fbi, going dark, william barr
Companies: apple

The FBI Can Get Into The Latest IPhones, So Why Is It Asking Apple To Break Encryption On Older Models?

from the reminder:-the-FBI-still-hasn't-updated-its-locked-device-count dept

The FBI has asked Apple to break the encryption on devices owned by the Pensacola Naval Base shooter. It hasn't made this request officially -- there's no court order being sought to compel Apple's assistance -- but it's asking nonetheless.

Attorney General Bill Barr put a little more muscle behind the FBI's informal request. His statement insinuated that Apple was making the country less safe by refusing to break encryption. He also stated that time was of the essence in cases like this and Apple's general unhelpfulness wasn't acceptable.

Apple fired back by again stating it would not break phone encryption for the US government. It also pointed out the FBI did not inform of it a second locked device until a month after the shooting. If the government was concerned about time slipping away, it did not act with alacrity during this latest investigation.

Donald Trump followed Bill Barr's lead, attacking Apple via Twitter with a particularly stupid tweet that suggests the president is still all about quid pro quo.

The administration is trying to turn public opinion against Apple. This will make it easier to push anti-encryption laws and policies. But the FBI doesn't seem to need Apple to break encryption for it. It has options it's apparently decided not to use in this case.

As we've noted earlier, a handful of tech companies offer devices that break or bypass encryption to pull data and communications from locked phones. Yes, it's still an arms race, with companies like Apple patching the flaws these tools exploit, but there's plenty of money to be made cracking open devices for government agencies.

The FBI isn't interested in these tools, except when it's convenient for the agency. Legal precedent compelling phone manufacturers to break encryption is infinitely more useful to the FBI. So, it chooses to ignore these options when it thinks it has a compelling case for encryption backdoors. That's what appears to be happening here.

Thomas Brewster of Forbes says the FBI has used third-party hacking tools to access the contents of Apple's latest iPhone.

Last year, FBI investigators in Ohio used a hacking device called a GrayKey to draw data from the latest Apple model, the iPhone 11 Pro Max. The phone belonged to Baris Ali Koch, who was accused of helping his convicted brother flee the country by providing him with his own ID documents and lying to the police.

If the FBI can get into the newest devices, why does it need Apple to break encryption on the shooters' phones, which are much older?

Given the models in the Pensacola shooting case are iPhones 5 and 7, it’s unclear why a GrayKey hasn’t proven useful in that investigation. Forbes has previously revealed a GrayKey brochure that showed it worked on older devices, too.

It's a question the DOJ probably doesn't want to answer. It will have to, though. Senator Ron Wyden has already asked the DOJ to explain its actions in this case.

The most obvious answer is this: this case pushes all the buttons the administration wants pressed. It involves the shooting of US military members by a foreigner. The San Bernardino shooting was pretty much the same thing: the shooting of government employees by foreigners. These are the only two cases where the FBI has gone public about its desire to force Apple to undermine its own encryption. For everything else, there are third-party hacking tools that actually give the FBI the evidence it wants without undermining the security of millions of iPhone users.

The FBI will only push for precedent when it thinks it has the public's support. It failed to read the room during the San Bernardino case. It hasn't gotten any better at gauging public opinion since then. Even with Barr and Trump going on the attack, the public's mood hasn't shifted. Compelled encryption-breaking makes everyone less secure, not just the targets of investigations. Trying to parlay dead people's phones into court precedent is not a good look for the agency. But the agency -- and the administration running it -- don't particularly care what the public wants or is best for it.

Filed Under: chris wray, doj, encryption, fbi, going dark, graykey, pensacola, technology, william barr

New Report Says Apple Dropped Plans To Fully Encrypt Backups After FBI Complained

from the encrypt-all-the-things dept

As Attorney General William Barr and other law enforcement officials continue to insist (falsely) that Apple refuses to cooperate with them in undermining encryption and security on all iPhones, plenty of people have been pointing out for years that the reality is that most iPhone encryption is effectively meaningless, because if a user has iCloud backups on, Apple retains the key to that data and can (and does!) open it up for legitimate law enforcement requests. In other words, it's extremely rare that full device encryption actually keeps law enforcement out (and that leaves aside the fact that technological solutions exist for law enforcement to hack into most iPhones anyway). Indeed. as you might recall, during the FBI's last big fight about encryption with Apple, over San Bernardino shooter Syed Farook's iPhone, it was revealed that the FBI's own incompetence resulted in Farook's backups being wiped out before the FBI had a chance to access them.

For quite some time now, EFF and others have urged Apple to close this loophole and allow for truly encrypted iCloud backups, such that even Apple can't get in. Apple has toyed with the idea, but as Tim Cook has said a few times, the company chose not to do it this way after weighing the pros and cons from a user's perspective. The key issue: if something is fully encrypted and Apple doesn't have the key, if you lose your password, the data is effectively gone. There is no "password reset" if Apple doesn't retain the key:

There our users have a key and we have one. We do this because some users lose or forget their key and then expect help from us to get their data back.

However, in that same interview, Cook did suggest that Apple would move towards encrypting backups as well:

It is difficult to estimate when we will change this practice. But I think that will be regulated in the future as with the devices. So we will not have a key for it in the future.

I think that there are legitimate user-centric reasons for the decision that Apple made, though it seems clear that many, many people don't realize that Apple still has the key to their backups. However, a new report from Reuters says that Apple killed plans to offer fully encrypted backups after the FBI got upset about it:

Apple Inc dropped plans to let iPhone users fully encrypt backups of their devices in the company’s iCloud service after the FBI complained that the move would harm investigations, six sources familiar with the matter told Reuters.

The tech giant’s reversal, about two years ago, has not previously been reported. It shows how much Apple has been willing to help U.S. law enforcement and intelligence agencies, despite taking a harder line in high-profile legal disputes with the government and casting itself as a defender of its customers’ information.

At the very least, this shows (yet again) that Barr and other law enforcement officials are blatantly lying when they say that Apple does not cooperate with law enforcement or that it doesn't take the concerns they raise seriously. On the flip side, it is a bad look for Apple, in that it has chosen to avoid a more secure option for its users' data, going against the company's long-standing public support for encryption and protecting users' data.

Again, even if there is a legitimate reason for not encrypting backups -- and it's equally true that if Apple did offer it, there would be public complaints of people no longer having access to their data -- it's troubling that Apple won't even make this an option (with clear warning statements) for end users, and that they're doing so because of blatant fearmongering by law enforcement officials.

Of course, the other way one might look at this decision is that if Apple had gone forward with fully encrypting backups, then the DOJ, FBI and other law enforcement would have gone even more ballistic in demanding a regulatory approach that blocks pretty much all real encryption. If you buy that argument, then failing to encrypt backups is a bit of appeasement. Of course, with Barr's recent attacks on device encryption, it seems reasonable to argue that this "compromise" isn't enough (and, frankly, probably would never be enough) for authoritarian law enforcement folks like Barr, and thus, it's silly for Apple to even bother to try to appease them in such a manner.

Indeed, all of this seems like an argument for why Apple should actually cooperate less with law enforcement, rather than more, as the administration keeps asking. Because even when Apple tries to work with law enforcement, it gets attacked as if it has done nothing. It seems like the only reasonable move at this point is to argue that the DOJ is a hostile actor, and Apple should act accordingly.

Filed Under: backups, doj, encryption, fbi, going dark, icloud, pressure
Companies: apple