DOJ Loses Another Attempt To Obtain Encryption-Breaking Precedent In Federal Court

from the senior-DOJ-counsel-sitting-in-darkened-office-with-'Behind-Blue-Eyes'-on dept

The DOJ is now 0-for-2 in encryption-breaking cases. The DOJ tried to get a judge to turn an All Writs Order into a blank check for broken encryption in the San Bernardino shooting case. Apple pushed back. Hard. So hard the FBI finally turned to an outside vendor to crack the shooter's iPhone -- a vendor the FBI likely knew all along could provide this assistance. But the DOJ wanted the precedent more than it wanted the evidence it thought it would find on the phone. It bet it all on the Writ and lost.

Other opportunities have arisen, though. A case involving wiretapping MS-13 gang members resulted in the government seeking more compelled decryption, this time from Facebook. The FBI could intercept text messages sent through Messenger but was unable to eavesdrop on calls made through the application. Facebook claimed it didn't matter what the government wanted. It could not wiretap these calls for the government without significantly redesigning the program. The government thought making Messenger less secure for everyone was an acceptable solution, as long as it gave investigators access to calls involving suspected gang members.

The case has proceeded under seal, for the most part, so it's been difficult to determine exactly what solution the government was demanding, but it appears removal of encryption was the preferred solution, which would provide it with future wiretap access if needed. If this request was granted, the government could take its paperwork to other encrypted messaging programs to force them to weaken or destroy protections they offered to users.

The ruling in this case is still under seal, but Joseph Menn and Dan Levine of Reuters were able to obtain comments from insiders familiar with the case to determine the outcome.

U.S. investigators failed in a recent courtroom effort to force Facebook to wiretap voice calls over its Messenger app in a closely watched test case, according to two people briefed on the sealed ruling.

[...]

Arguments were heard in a sealed proceeding in a U.S. District Court in Fresno, California weeks before 16 suspected gang members were indicted there, but the judge ruled in Facebook’s favor, the sources said.

The DOJ was hoping to have Facebook held in contempt for failing to comply with the decryption order. It appears this isn't going to happen. The government may need to seek outside assistance to intercept Messenger calls. But that's a much more difficult prospect than breaking into an iPhone physically in the possession of the government and it would possibly involve vulnerabilities that might be patched out of existence by developers.

The government is presumably hunting down its next test case for encryption-breaking precedent. With the Supreme Court finding for the Fourth Amendment in two recent cellphone-related cases, the chance of obtaining favorable precedent continues to dwindle.

Filed Under: backdoors, doj, encryption, facebook messenger, fbi
Companies: facebook

State Attorneys General Really Want To Go After Big Internet Companies; But Claim It's About Privacy, Not Bias

from the we'll-see... dept

We've written a few times about how Attorney General Jeff Sessions' plan to meet with State Attorneys General about going after big internet companies for perceived political bias was a clear First Amendment problem. He still held the meeting earlier this week, and it appears that at least some of the attendees agreed that targeting how the platforms present content was likely a non-starter, even if Sessions apparently kept trying to raise it as an issue. From a Washington Post report that quotes a few people who were in attendance:

Attorney General Jeff Sessions opened the meeting by raising questions of possible ideological bias among the tech companies and sought to bring the conversation back to that topic at least twice more, according to D.C. Attorney General Karl A. Racine.

Of course, the fact that the others in attendance mostly pushed past the question of political bias isn't exactly good news for the internet platforms, as the AGs apparently focused on other ways they could and should target the companies:

“We were unanimous. Our focus is going to be on antitrust and privacy. That’s where our laws are,” Jim Hood, Mississippi’s attorney general, said in an interview.

Of course, it seems like almost journalistic malpractice to quote Jim Hood talking about going after social media platforms without mentioning the fact that he was the centerpiece of a the conspiracy by the top movie studios to attack Google with nonsensical complaints about illegal things he found while doing searches on Google. If you don't recall, the Sony hack revealed a plot by the legacy movie studios to have their lawyers effectively run an investigation for Jim Hood -- and even the NY Times revealed that his eventual subpoena to Google was written by the MPAA's lawyers. A judge reviewing Google's legal fight with Hood noted that it seemed pretty clear that Hood's actions were done in "bad faith." So... consider me at least marginally skeptical that Hood is an objective voice on what is and is not appropriate for a state Attorney General to investigate regarding the big internet platforms.

Obviously, if there are real antitrust violations, then that's a valid issue to explore. But, so many of the attacks themselves seem to be a hell of a lot more "politically biased" than any of the claims about how the internet companies themselves are politically biased.

And while there was some talk about the privacy practices of the various platforms (which, while they may be concerning, it's not clear how any of them violate any laws...), some of the talk also involved an astounding incomprehension of the encryption discussion. And, for that, we'll go back to Jim Hood again:

For other states, the issue was the tech industry’s relationship with law enforcement. That included talk about Apple and “how we in law enforcement depend on cellphones.” Hood said that Apple has “waved at us and didn’t use all their fingers” in its handling of encryption.

That is not at all an accurate portrayal of what happened. Apple was making sure that everyone's information was safe by using strong encryption. The FBI sought to undermine that safety by demanding that Apple make a massive, and very dangerous, change to its software.

Indeed, it's quite incredible for Hood to bring this up in the context of the AGs discussing "privacy" concerns about how the big tech companies handle data. If you want them to protect data, you want them to use strong encryption. Yet, here, Hood is whining that Apple dared to actually protect people's privacy.

So... if tech companies actually protect people's privacy with strong encryption, they get yelled at and threatened with legal action by Attorneys General. And if they don't protect people's privacy... they get yelled at and threatened with legal action by Attorneys General. Just what exactly are they supposed to do?

Again, it is entirely possible that these companies have violated various laws. Perhaps they're in violation of antitrust laws, though the evidence there is lacking so far. But, from everything that's been said coming out of this meeting, it does not inspire much confidence that there are reasonable and objective reasons for taking legal actions against these platforms. Instead -- and this is all too typical for state AGs -- there appears to be a lot of grandstanding and bluster without much substance.

Filed Under: antitrust, encryption, first amendment, free speech, internet, jeff sessions, jim hood, privacy, social media
Companies: apple, facebook, google

ICE Leads The Nation In Encryption-Cracking Expenditures

from the [not-pictured:-the-Federal-Bureau-of-Sucking-At-Counting-Phones] dept

We don't hear much from anyone other than FBI officials about the "going dark" theory. The DOJ pitches in from time to time, but it's the FBI's baby. And it's an ugly baby. Earlier this year, the FBI admitted it couldn't count physical devices. The software it used to track uncrackable devices spat out inflated numbers, possibly tripling the number of phones the FBI claimed stood between it and justice. FBI officials like James Comey and Chris Wray said "7,800." The real number -- should it ever be delivered -- is expected to be less than 2,000.

The FBI also hasn't been honest about its efforts to crack these supposedly-uncrackable phones. Internal communications showed the agency slow-walked its search for a solution to the San Bernardino shooter's locked iPhone, hoping instead for a precedential federal court decision forcing device manufacturers to break encryption whenever presented with a warrant.

The FBI appears to have ignored multiple vendors offering solutions for its overstated "going dark" problem. At this point, it's public knowledge that at least two vendors have the ability to crack any iPhone. Israel's Cellebrite -- the company presumed to have broken into the San Bernardino phone for the FBI -- is one of them. The other is GrayShift, which sells a device called GrayKey, which allows law enforcement to bypass built-in protections to engage in brute force password cracking.

We don't know how often the FBI avails itself of these services. A pile of locked phones numbering in the thousands (but which thousands?!) suggests it is allowing the serviceable (vendor services) to be the enemy of the perfect (favorable court rulings and/or legislation).

Other federal agencies aren't waiting around for the next horrifying terrorist attack to nudge Congress towards mandating encryption backdoors. They're spending tax dollars now to take advantage of vulnerabilities that may be patched out of existence in the near future, if they haven't been addressed already. Thomas Brewster of Forbes has spent some time sifting through government records to see who's buying and how much they're spending. The FBI isn't on the list. The DEA is. But the Daddy Warbucks of federal law enforcement agencies is none other than the one voted Most In Need Of Immediate Abolishment.

According to government contract records on FPDS.gov, ICE acquired the services of GrayShift earlier this month. And it’s spent more than any other government department on GrayShift tech, with a single order of $384,000. Other branches of the Trump government, from the Drug Enforcement Administration to the Food and Drug Administration, have splashed between $15,000 and $30,000 on different models of the GrayKey, which requires physical access to an Apple device before it can break through the passcode.

ICE wants everything on the menu. In addition to spending big on cellphone-cracking devices, the agency has also thrown money at forensic tools from Cellebrite, social media tracking software, "intercept software" from a Nebraska-based vendor, and "computer support equipment" from foreign companies (one of them Russian) known for their ability to extract data from encrypted messaging services.

It would seem the agency involved in investigating the widest variety of crimes would be joining ICE in its encryption-breaking spending spree. But there's no trace of FBI expenditures to be found in these records. It may be the FBI has exempted itself from reporting this information under the theory that naming dollar amounts and/or vendors would allow wily criminals to escape its grasp. If so, it seems unlikely this refusal has a legal basis. The DEA and ICE have both allowed these records to be published and both agencies routinely engage in investigations that theoretically could be compromised by making spending data public. (The key is "theoretically." In reality, it's unlikely publishing contract data has any noticeable effect on criminal behavior.)

Moving past the FBI, there's reason to be concerned ICE is making purchases like these. Given its main concern is the speedy removal of undocumented immigrants, this tech seems to be more of a "want" than a "need." Most of the cases ICE deals with don't need to involve cracked phones and forensic searches. But because it has the tools on hand, it will make sure it gets our money's worth.

Filed Under: backdoors, encryption, ice, phones

Five Eyes Surveillance Agencies Say Encryption Is Good, Except When It Keeps Them From Looking At Stuff

from the shorter-Five-Eyes:-we-like-encryption-that-doesn't-work dept

The Five Eyes nations -- UK, US, Australia, Canada, and New Zealand -- still think there's a way to create encryption backdoors (that they studiously avoid calling backdoors) that will let the good people in and the bad people out.

The backlash against government calls for backdoors has made these demands a bit more subdued in most Five Eyes countries. The UK government really doesn't seem to care and uses every terrorist attack as another reason to prevent law-abiding citizens from using secure encryption for their communications. Others members have taken a more measured approach, talking around the subject while legislative inroads continue unabated.

In the US, the periodic "going dark" discussions have taken on a (no pun intended) darkly comical tone as FBI and DOJ officials continue to claim harder nerding with solve the "problem" it has misrepresented for years.

The countries may be taking different approaches to undermining encryption, but they're all still looking to do this in the future if they can just find a way to sell it to the public without the actual nerds speaking up and ruining all their plans. The Register notes the Five Eyes surveillance partnership has delivered another ultimatum (that it won't call an ultimatum) about encrypted communications following a meeting in Australia. But it is taking care to couch its wants and desires in pretty words about the safety and security of the general public.

In an official communiqué on the confab, they claim that their inability to lawfully access encrypted content risks undermining democratic justice systems – and issue a veiled warning to industry.

The group is careful to avoid previous criticisms about their desire for backdoors and so-called magic thinking – saying that they have "no interest or intention to weaken encryption mechanisms" – and emphasise the importance of privacy laws.

But the thrust of a separate framework for their plans, the Statement of Principles on Access to Evidence and Encryption, will do little to persuade anyone that the agencies have changed their opinions.

"Privacy laws must prevent arbitrary or unlawful interference, but privacy is not absolute," the document stated.

And there it is. The only thing Five Eyes considers "absolute" is its supposed "right" to access contents of devices and communications. First, the confab talks about "mutual" cooperation, as though the tech industry is being unnecessarily resistant to undermining protections it provides to users. Five Eyes may not have the strength of conviction to actually demand encryption backdoors, but the wording here indicates what it wants is pretty much just a backdoor.

Providers of information and communications technology and services - carriers, device manufacturers or over-the-top service providers -– are subject to the law, which can include requirements to assist authorities to lawfully access data, including the content of communications. Safe and secure communities benefit citizens and the companies that operate within them.

This means key escrow or having encryption removed during transit so service providers can access contents of communications. Nothing about either plan makes users safer or less accessible to malicious parties not associated with the Five Eyes partnership.

The next section's headline makes it clear who's going to be answering to who:

Rule of law and due process are paramount

In other words, if you've got a warrant, I guess you're gonna come in I'll let you in. This appeal to authority says providers must subject themselves to pestering governments, even if it means harming their entire userbase just so the government can go after a few users. The nod to due process really means nothing, what with indefinite gag orders accompanying demands for communications and data, and an ongoing refusal by government agencies to discuss surveillance means and methods in open court. As long as parallel construction is still a thing, due process will never be given the respect it deserves.

So, Five Eyes may be trying to make it sound like the countries agree encryption is a valuable protection for its collective citizens, but what it really wants is the protection to be weakened to the point law enforcement -- and anyone else not governed by the rule of law -- can access it at will. No one's saying "backdoor," but they're all thinking it very loudly.

Filed Under: backdoors, encryption, five eyes, surveillance

DOJ Asking Court To Force Facebook To Break Encryption On Messenger Voice Calls

from the with-an-eye-on-undermining-all-encrypted-messaging-services dept

The DOJ's war on encryption continues, this time in a secret court battle involving Facebook. The case is under seal so no documents are available, but Reuters has obtained details suggesting the government is trying to compel the production of encryption-breaking software.

The U.S. government is trying to force Facebook Inc to break the encryption in its popular Messenger app so law enforcement may listen to a suspect’s voice conversations in a criminal probe, three people briefed on the case said, resurrecting the issue of whether companies can be compelled to alter their products to enable surveillance.

The request seeks Facebook's assistance in tapping calls placed through its Messenger service. Facebook has refused, stating it simply cannot do this without stripping the protection it offers to all of its Messenger users. The government disagrees and has asked the court for contempt charges.

Underneath it all, this is a wiretap order -- one obtained in an MS-13 investigation. This might mean the government hasn't used an All Writs Acts request, but is rather seeking to have the court declare Messenger calls to be similar to VoIP calls. If so, it can try to compel the production of software under older laws and rulings governing assistance of law enforcement by telcos.

A federal appeals court in Washington D.C. ruled in 2006 that the law forcing telephone companies to enable police eavesdropping also applies to some large providers of Voice over Internet Protocol, including cable and other broadband carriers servicing homes. VoIP enables voice calls online rather than by traditional circuit transmission.

However, in cases of chat, gaming, or other internet services that are not tightly integrated with existing phone infrastructure, such as Google Hangouts, Signal and Facebook Messenger, federal regulators have not attempted to extend the eavesdropping law to cover them, said Al Gidari, a director of privacy at Stanford University Law School’s Center for Internet and Society.

Calls via Messenger are still in a gray area. Facebook claims calls are end-to-end encrypted so it cannot -- without completely altering the underlying software -- assist with an interception. Regular messages via Facebook's services can still be decrypted by the company but voice calls appear to be out of its reach.

Obviously, the government would very much like a favorable ruling from a federal judge. An order to alter this service to allow interception or collection could then be used against a number of other services offering end-to-end encryption.

It's unknown what legal options Facebook has pursued, but it does have a First Amendment argument to deploy, if nothing else. If code is speech -- an idea that does have legal precedent -- the burden falls on the government to explain why it so badly needs to violate a Constitutional right with its interception request.

This is a case worth watching. However, unlike the DOJ's very public battle with Apple in the San Bernardino case, there's nothing to see. I'm sure Facebook has filed motions to have court documents unsealed -- if only to draw more attention to this case -- but the Reuters article says there are currently no visible documents on the docket. (The docket may be sealed as well.) There is clearly public interest in this case, so the presumption of openness should apply. So far, that hasn't worked out too well for the public. And if the DOJ gets what it wants, that's not going to work out too well for the public either.

Filed Under: doj, encryption, facebook messenger, voip, wiretapping
Companies: facebook

Australian Gov't Floats New Batch Of Compelled Access Legislation With An Eye On Encryption

from the hello-darkness-my-old-friend dept

The Australian government is looking to revamp its compelled access laws to fight encryption and other assorted technological advances apparently only capable of being used for evil. It's getting pretty damn dark Down Under, according to the Department of Home Affairs' announcement of the pending legislation.

Encryption conceals the content of communications and data held on devices, as well as the identity of users. Secure, encrypted communications are increasingly being used by terrorist groups and organised criminals to avoid detection and disruption. The problem is widespread, for example:

• Encryption impacts at least nine out of every ten of ASIO’s priority cases.

• Over 90 per cent of data being lawfully intercepted by the AFP now use some form of encryption.

• Effectively all communications among terrorists and organised crime groups are expected to be encrypted by 2020.

An example of harmful encryption is provided for readers at home, so they can weigh their own security and privacy against an anecdote about a registered sex offender who may or may not have escaped prosecution (the outcome of the case isn't provided) by using encrypted messaging apps. And it includes an inadvertently helpful lesson about the stupidity of targeting encryption with legislation, even if the DHA likely doesn't realize it.

The suspect was arrested and his mobile phone was seized but despite legislative requirements he refused to provide his passcode.

There's the limitation of lawmaking. Lawbreakers break laws and they're not going to stop just because you've told them not to with a government mandate. Legislation [PDF] like this does little more than make life more difficult for service providers and device makers while undermining the privacy and security of millions of law-abiding citizens.

The explanation sheet [PDF] notes the government is not seeking to mandate encryption backdoors. That being said, it would like providers of encrypted services/devices to leave the door cracked open so the government can step inside whenever it feels the need to look around.

The type of assistance that may be requested or required under the above powers include (amongst other things):

• Removing a form of electronic protection applied by the provider, if the provider has an existing capability to remove this protection.

• Providing technical information like the design specifications of a device or the characteristics of a service.

• Installing, maintaining, testing or using software or equipment given to a provider by an agency.

• Formatting information obtained under a warrant.

• Facilitating access to devices or services.

• Helping agencies test or develop their own systems and capabilities.

• Notifying agencies of major changes to their systems, productions or services that are relevant to the effective execution of a warrant or authorisation.

• Modifying or substituting a target service.

• Concealing the fact that agencies have undertaken a covert operation.

The law can't retroactively force companies to produce crackable devices and messaging systems. But the first bullet point could see the Australian government demanding they do so in the future if they want to provide goods and services to the Australian public. Fortunately, the bill includes a clause making future demands along these lines impossible for the time being.

The Bill expressly prohibits technical assistance notices or technical capability notices from requiring a provider to build or implement a systemic weakness or systemic vulnerability into a form of electronic protection. This includes systemic weaknesses that would render methods of authentication or encryption less effective. The Australian Government has no interest in undermining systems that protect the fundamental security of communications. The new powers will have no effect to the extent that requirements would reasonably make electronic services, devices or software vulnerable to interference by malicious actors. Importantly, a technical capability notice cannot require a provider to build a capability to remove electronic protection and puts beyond doubt that these notices cannot require the construction of decryption capabilities.

Without further discussion by the legislature, it's tough to tell whether creating an escrow system would be considered a "system weakness" or make "encryption less effective." I mean, it obviously is and does, but does the DHA see it that way? And will this clause survive the final markup? Compelling decryption using "existing" methods seems especially useless if most services and devices cannot currently be decrypted by providers. The government is better off seeking outside help from contractors who do nothing else but find ways to crack or bypass encryption, rather than dropping language into the law that suggests backdoors the government won't call "backdoors" will be mandated in the future.

It also gives the government a considerable expansion of power, allowing it to peruse private companies' design specs and a heads up if any redesigns are in the works. It also forces companies to be compliant partners in government surveillance by mandating their assistance in man-in-the-middle attacks ("modifying or substituting a target service") and ordering them to withhold information from affected customers.

There is a public comment period, which is a nice touch. There also appears to be some respect for the good encryption does, rather than simply viewing it as an escape route for criminals and terrorists. But there's also a good deal of power expansion tied to rickety wording that suggests backdoors might be mandated if the government can talk itself into viewing proposals as something other than backdoors. And there's no guarantee this vague promise will make the final cut.

Filed Under: australia, backdoors, encryption, going dark, law enforcement, surveillance

BBC Migrates Everything To HTTPS, Immediately Finds Itself Blocked By The Chinese Government

from the weird-freedom-of-not-giving-a-damn-how-much-it-sucks-for-your-constituents dept

Move to HTTPS; lose the Chinese. That's the revised internet maxim. China's Great Firewall has gradually reduced the number of foreign sites accessible by Chinese citizens... "gradually" only in the sense that it's been a continuous rollout steadily decreasing web access. The government blocked an entire content delivery network at one point, so even this gradual rollout has seen its share of spikes.

As is being collaboratively reported at WikiTribune, the BBC says the move to HTTPS for all of it properties has resulted in Chinese citizens being unable to access their contents.

"In accordance with internet industry good practice, the BBC is currently changing the format of internet sites from HTTP to HTTPS. This means content is less vulnerable to tampering and specific pages on our websites can no longer be blocked. Recently the BBC Chinese language site has changed to this new format," a BBC spokesperson told WikiTribune on Wednesday.

The spokesperson added that the corporation’s online audience in China has had no access to any of the BBC’s websites for "around a week."

The BBC recommends a VPN to bypass Chinese web filtering, but that suggestion only goes so far in country where VPN use has been banned for the most part. Businesses still rely on VPNs for securing their communications and content, so the capitalist heart of the authoritarian government has granted exceptions. But the exceptions are limited to VPNs registered with the government, which presumably contain government backdoors.

Government-approved VPNs won't be much use to citizens looking to read news the government has already expressed an interest in blocking. And citizens looking to keep their Citizen Scores™ from dropping will be better off seeking out approved news sources using the heavily-regulated web the government provides.

Filed Under: blocked, china, encryption, https
Companies: bbc

WhatsApp Rightly Refuses Indian Government's Silly Demand To Break Encryption

from the that's-not-the-problem dept

A few weeks back we wrote about the awful situation in India where mob violence has been leading to people being lynched. Often this is coming as misinformation is being spread online. Rather than deal with the root causes of this violence, people have been pointing fingers at WhatsApp, the messaging software (owned by Facebook) that has been the main source of the disinformation. As we pointed out in our original post, it seemed silly to blame the messaging app. We pointed to a compelling argument that the Indian government should be the one taking most of the blame here. In that article, by Abhimanyu Ghoshal, he noted:

Instead of blaming WhatsApp, India’s government needs to tackle the larger issues that are making its people paranoid and vulnerable to the viral spread of lies. Hell, it could even use WhatsApp to do that.

Last year, the Bharatiya Janata Party, which is currently in power in the country, was reportedly working to set up roughly 5,000 WhatsApp groups to spread its campaign messaging for the 2018 assembly elections across the southern state of Karnataka, which is home to some 61 million people.

For starters, it should launch a campaign to encourage people to question the veracity of information they receive via social media and messaging platforms. It also needs to remind people about the laws that they must adhere to within the country’s borders.

So, anyone want to take a guess on whether or not the government did any of that? Oh, don't be silly. Of course they didn't. Instead, they demanded that WhatsApp break its encryption to allow for government surveillance of who initiated various disinformation campaigns. Thankfully, WhatsApp is refusing to give in to these demands.

“We remain deeply committed to people’s privacy and security, which is why we will continue to maintain end-to-end encryption for all of our users,” the company said.

The question is what happens now. The Ministry of Electronics and IT in India has said that a failure to break the encryption will lead to legal action against the company. What's incredible in reading the framing of this by the Ministry is that it seems to bend over backwards to want to make sure everyone thinks the problem here is 100% the fault of WhatsApp.

MeitY had written to Whatsapp exhorting them to take immediate steps to tackle the menace of misuse of their platform wherein inflammatory messages were circulated that led to unfortunate incidents. On the same day Whatsapp responded indicating their initiative to mark forwarded messages and to step up efforts to detect fake news.

Subsequently, an unfortunate incident has occurred in Bidar where a 32 year old software engineer Mohammed Azam was killed and this was preceded by viral circulation of rumours on Whatsapp about child lifters. It is regretted that the enormity of the challenge and the rampant abuse happening in the country leading to repeated commissioning of crimes pursuant to rampant circulation of irresponsible messages in large volumes on their platform have not been addressed adequately by Whatsapp.

Why should it be WhatsApp's fault that people are using the platform in this manner? As that report from Ghoshal noted, a big part of the reason why people are lynching others falsely accused of kidnapping is because they have no faith in the government to adequately investigate and arrest those who are actually breaking the law. But, nope, to the government, it's all WhatsApp's fault.

Reports in the media resonate the general sentiment that there is much more that needs to be done by Whatsapp. There is a need for bringing in traceability and accountability when a provocative / inflammatory message is detected and a request is made by law enforcement agencies. When rumours and fake news get propagated by mischief mongers, the medium used for such propagation cannot evade responsibility and accountability. If they remain mute spectators they are liable to be treated as abettors and thereafter face consequent legal action.

In light of the above, Whatsapp has been requested today to come out with more effective solutions that can bring in accountability and facilitate enforcement of law in addition to their efforts towards labeling forwards and identifying fake news. It has been conveyed to them in unmistakable terms that it is a very serious issue which deserves a more sensitive response.

This truly is incredible, if not entirely surprising. The Indian government has failed to put in place adequate institutions for a functioning society, and when things break down into mob violence, rather than seeking the (admittedly difficult) job of fixing those institutions and setting up for adequate governance, they just point their fingers at messaging app. What an utter failure.

Filed Under: blame the messenger, encryption, india, institutions, mob violence
Companies: facebook, whatsapp

New Report Says The Feds' Focus On Device Encryption Is Holding Local Law Enforcement Back

from the get-what-you-can-instead-of-dreaming-about-an-all-access-pass dept

CSIS (Center for Strategic and International Studies) has just released another report [PDF] on device encryption. But there's a difference: this one isn't so much about encryption but what law enforcement isn't doing to access the wealth of digital data available to it. (h/t Robyn Greene)

What CSIS found is there are plenty of powerful tools and options available. The problem -- especially at the local level -- is law enforcement appears to be unsure of how to proceed when seeking digital data. This results in a couple of problems, the latter of which has definite civil liberties implications.

Our survey of federal, state, and local law enforcement officials suggests that challenges in accessing data from service providers—much of which is not encrypted—is the biggest problem that they currently face in terms of their ability to use digital evidence in their cases. Specifically, the inability to effectively identify which service providers have access to relevant data was ranked as the number-one obstacle in being able to effectively use digital evidence in particular cases.

Following closely after that is the difficulty of obtaining data and evidence from service providers if agencies do manage to narrow down where it's located. While there are a variety of federal resources available to train and educate law enforcement investigators about seeking digital evidence, they're underfunded and underutilized.

This lack of education and overall uncertainty is leading to unfortunate results -- both in terms of targeted citizens and the law enforcement agencies hoping to hold onto whatever evidence they may obtain. Overbroad warrants are routine and it's not always the result of a "collect it all" philosophy.

Law enforcement claims... they often lack enough information to know what data is and is not available and make the kind of relevancy determination needed. Put simply, unless law enforcement officials are adequately informed about what kind of data providers have available, they are not in a position to know what there is to ask for—let alone determine if it is relevant. Law enforcement officials also point out that in many cases it is appropriate to ask for “any and all data,” particularly when the universe of available data is sufficiently limited—for example, if the request is directed toward “any and all data” about a particular account and during a specific time horizon.

These broad requests result in pushback from tech company recipients (who, unfortunately, likely understand the law better), which further strains the relationship between service providers and law enforcement agencies. The problem with the law enforcement side is the numbers don't support this perception.

The number of law enforcement requests, at least as directed at the major U.S.-based tech and telecom companies, has significantly increased over time. Yet, the response rates have been remarkably consistent.

The increase in requests has led to an increase in rejected requests as a whole -- which fuels the perception service providers are giving lawmen the figurative finger -- but the percentage of rejected requests (around 20%) has remained constant.

It's not just law enforcement personnel needing more training and info. The lack of training leads to broad warrant requests and subpoenas from law enforcement. These requests should be receiving pushback before they're delivered to service providers. But far too often, they're not receiving enough scrutiny at the judicial level. This is also an education/information problem.

[R]esources should be invested in training judges, in addition to law enforcement officials engaged in the investigative and prosecutorial functions. Judges serve as crucial intermediaries in the request process, ensuring that data requests are lawful and appropriately tailored. Resources should also be expended to train defense attorneys, who also need the ability to access and interpret digital evidence in order to mount an adequate defense.

The broad requests that do make it through post additional issues that are rarely discussed. While FISA court orders authorizing surveillance (including domestic surveillance) stress minimization of non-target info, demands for data from service providers aren't subject to these restrictions. Data/communication dumps can expose a lot of info about non-targets and there's almost zero recourse for non-targets whose privacy has been violated. "Incidental" collection isn't just something the NSA does. It's the inevitable byproduct of overbroad requests and few, if any, rules governing the collection and use of this info.

The report details a large number of deficiencies in the process which has made law enforcement's job far more difficult than it needs to be. Tech advances don't solely benefit crafty criminals. They also aid law enforcement, but there's been no cohesive effort made by the federal government to ensure local agencies can make the most of the tools available. Until this is nailed down, worrying about defeating or bypassing encryption is a waste of time.

That the FBI's director has decided that's how he's going to use his time and energy, suggests the agency -- the most frequent contact for local agencies seeking tech help -- isn't going to prioritize sharing knowledge over seeking legislative mandates. The FBI is hurting itself and others by limiting their ability to do everything they can right now in hopes of getting a law enforcement-sized hole drilled in encryption at some point in the next few decades.

Filed Under: doj, encryption, fbi, going dark, law enforcement
Companies: csis

FBI Boss Chris Wray: We Put A Man On The Moon So Why Not Encryption Backdoors?

from the yeah-ok-then dept

Despite the FBI finally admitting it had greatly exaggerated the number of encrypted devices it can't get into, FBI Director Chris Wray keeps pushing the "going dark" theory to whoever will listen. This time it was NBC's Lester Holt. In an interview during the Aspen Security Forum, Wray again hinted he was moving towards an anti-encryption legislative mandate if some sort of (impossible) "compromise" couldn't be reached with tech companies. (Transcription via Eric Geller.)

I think there should be [room for compromise]. I don't want to characterize private conversations we're having with people in the industry. We're not there yet for sure. And if we can't get there, there may be other remedies, like legislation, that would have to come to bear.

The "compromise" Wray wants is simple: if law enforcement has a warrant, it gets access. The solution isn't. To weaken or backdoor encryption to serve law enforcement's needs makes everyone -- not just criminal suspects -- less safe. If a hole can be used by good guys, it can be used by bad guys. And even the best guys can't prevent their tech tools from making their way into the public domain. Just ask the NSA and CIA. In the case of the NSA, leaked exploits resulted in worldwide ransomware attacks.

Wray pitches an impossibility by portraying it as a lack of effort by the tech industry. The tech industry -- the one with all the "brightest minds" -- have been consistent in their stance. A hole for one is a hole for all. There's no such thing as securely-compromised encryption. Wray's response has also been consistent: they're just not thinking hard enough. The only "compromise" pitched by members of the tech sector is basically re-skinned key escrow -- the thing that went out of fashion with the death of the Clipper Chip.

Wray's pitch now includes an appeal to the modern wonders of the world, as if these examples change the equation at all:

We're a country that has unbelievable innovation. We put a man on the moon. We have the power of flight. We have autonomous vehicles… [T]he idea that we can't solve this problem as a society -- I just don't buy it.

First off, bringing the space program into this is ridiculous. All it does is demonstrate the government has access to some of the best minds, but Wray expects the private sector to provide, maintain, and bear the expense of a law enforcement-friendly encryption "solution." (And if it fails to deliver, Wray's more than willing to ask the government to force the private sector to play ball.)

Second, putting a man on the moon was the side effect of a Cold War cock-measuring contest with the USSR. While the nation has derived many benefits over the years from the space program, the "man on the moon" mission was a way of expressing superiority and implying that our weaponry was similarly advanced. The US government showed the world how powerful it was. I don't think that's the analogy you want to make when discussing personal device encryption.

And third, the whole "putting a man on the moon" analogy was solidly mocked on John Oliver's program two years ago when he quoted cryptography expert Matt Blaze accurately saying, "When I hear 'if we can put a man on the moon, we can do this' I'm hearing an analogy almost saying "if we can put a man on the moon, surely we can put a man on the sun.'" Not every issue is the equivalent of putting a man on the moon.

While the others listed are private sector achievements, they're simply not good comparisons. Encryption methods continue to advance in complexity and ease-of-use. This is innovation, even if it's innovation Chris Wray doesn't like. Each of the innovations listed solved problems and created markets. In this case the problem is device security. Encryption solves it. Who wants secure devices? Everyone who buys one.

The rise of smartphones has seen users replace their houses with handheld devices as the primary storage for a life's-worth of documents, along with access to a great deal of financial and personal info. Device makers want to ensure a stolen phone doesn't mean a stolen life. Wray (and others) don't want to do anything more than obtain warrants to scrape the digital innards of devices they seize. In other words, when the FBI encounters a locked safe in someone's house, Wray would believe it's the manufacturer's fault for the safe failing to unlock immediately in the presence of a search warrant.

Still, Wray believes society as a whole would be better off with weaker encryption because sometimes terrorists and criminals use encryption.

Because to the extent that the bad guys have shifted more and more to living their whole lives through encrypted devices and encrypted messaging platforms, that if we don't find a way to access that information with lawful process, we're in a bad place as a country.

Default encryption has been around for a few years now and there's no evidence we're less safe as a nation. Very few prosecutions have been dead-ended because investigators couldn't get into a phone. The problem is presented as swiftly-growing and inevitable, but there's been nothing delivered as evidence of these claims. The FBI has continually pointed to its growing pile of locked devices as Exhibit A in the War on Encryption, but has never presented anything at all to give these claims of diminishing public safety any credence. All we know for sure at this point is the FBI can't count. It used a wrong number (~7,800) to push the narrative and still expects us to believe it after it admitted this count was nearly four times higher than the actual number of devices in its possession.

Wray needs to stop complaining about the tech sector until his own agency can demonstrate its ability to approach the issue with facts, verified numbers, and intellectual honesty.

Filed Under: backdoors, chris wray, encryption, fbi, going dark, man on the moon